Exclusive key sharing method

ABSTRACT

In a set-up phase, the base station formulates the secret key S and holds it in secret. The secret information Si which are obtained by dividing the secret key S are distributed in secret to respective terminals  1  to  5  by using cryptographic communication means. In a preparatory phase, the base station  0  broadcasts the preparatory information C 1 (=g k  modp), the exclusive information C 2 (=y5 k  modp), the ciphertext C 3 (=M×K modp), and the particular terminal number  5  to all terminals. In a key sharing phase, the terminal  1  calculates a product of C 1 {circumflex over ( )}(λ(1, Λ) modq) modp and C 2 {circumflex over ( )}(λ(5, Λ) modq) modp by using the preparatory information C 1  and the exclusive information C 2  to obtain K and then calculates M, which are common data to the base station  0 , by dividing the ciphertext C 3  by K. The terminals  2  to  4  execute similar calculations. As a result, the terminals  1  to  4  can share mutually the common data M.

TECHNICAL FIELD

The present invention relates to a cryptographic key sharing method employed in a star communication system consisting of a base station and a plurality of terminals or a communication system consisting of only a system manager and a plurality of terminals and, more particularly, a key sharing method which is capable of safely distributing a common secret key to all terminals except terminals specified by the base station, and a key sharing method which is capable of safely distributing the common secret key only to particular terminals.

BACKGROUND ART

In the star communication system in which the base station manages a plurality of terminals, the case is discussed where the base station and a plurality of subsidiary terminals constitute a group and then the same group secret key is shared with the group members to broadcast the cipher communication. Information encrypted by using the group secret key can be decrypted only by the terminals which have the same secret key in the group.

Meanwhile, the case where particular terminals should be excluded from this group will occur. There are cases where, for example, a certain terminal in the group is robbed and thus illegal practices such as the eavesdrop of the cipher communication, the transmission of false information, etc. are conducted by using the terminal. At this time, the base station which manages this secret key must exclude the stolen terminal as soon as possible and update the group secret key, and only remaining terminals must share a new secret key.

Also, it is necessary to construct another group newly. There are cases where the out-of-group terminal is entered into the group, the terminals which belong to different groups are combined into one group, etc. At this time, the base station must share a new group key as soon as possible with the terminals constituting the group.

FIG. 29 shows a key updating method to share the key data with terminals other than the terminals specified by the base station, according to the first example in the prior art. In FIG. 29, five terminals T₁ to T₅ hold inherent keys k₁ to k₅ respectively, and the base station manages the inherent keys of all terminals. At this time, the case where, for example, the base station excludes the terminal T₁ and distributes a new common secret key to other terminals T₂ to T₅ will be explained hereunder.

First, the base station generates the secret key K, encrypts this secret key K by using k₂ to k₅ as keys respectively, and distributes them to the terminals T₂ to T₅ respectively. Respective terminals except the excluded terminal T₁ decrypt the encrypted keys by using the inherent keys to obtain the secret key K. In FIG. 29, for example, Ek₂(K) is the ciphertext which is obtained by encrypting K by using the inherent key k₂. Since data on this communication line are encrypted by the inherent keys of the terminals T₂ to T₅ respectively, the terminal T₁ cannot obtain the secret key K generated by the base station even if such terminal T₁ can intercept this communication data.

However, according to this method, in order to exclude one terminal from N terminals, normally the base station must perform (N−1) time the encryption and transmit (N−1) pieces of data. If a size of the group is increased, this operation becomes extremely a burden on the base station. In addition, the services such as the cipher communication, etc. in the group must be stopped until all station have been updated. In this case, if the service suspending term which is required until distribution of data to (N−1) terminals has been finished is prolonged, the weighty problem has arisen.

FIG. 30 shows a key updating method, which is disclosed in Patent Application Publication (KOKOKU) Hei 5-46731, according to the second example in the prior art. In this second example in the prior art, the public key cryptosystem is employed. In FIG. 30, five terminals T₁ to T₅ hold intrinsic secret keys (e₁, d₁) to (e₅, d₅) respectively. Here, suppose that

e _(i) ·d _(i) mod(p−1)=1 (p is a prime number of the system publication)

can be satisfied in each secret key (e_(i), d_(i)). The base station 1 manages the public keys

p ₁ =g ^(e1) modp, . . . , p ₅ =g ^(e5) modp

of all terminals. Where g is an integer of the system publication. To calculate the secret key (e_(i), d_(i)) of each terminal based on the public key p_(i) of each terminal and information g, p of the system publication is difficult because it arrives at the discrete logarithm problem if the bit length is set long. Like the example 1 in the prior art, if the terminal T₁ should be excluded, first the base station generates a random number R and generates a key

K=g ^(R) modp

and thus calculates

Z ₂ =p ₂ ^(R) modp, . . . , Z ₅ =p ₅ ^(R) modp

and then distributes them to T₂ to T₅ except the terminal T₁. The respective terminals i except the terminal T₁ obtain the updated keys K

K=Z _(i) ^(di) modp(=(p _(i) ^(R))^(di) modp=((g ^(ei))^(di))^(R) modp=g ^(R) modp),

which are common to the base station, by using the received Z_(i) and the secret key d_(i).

However, according to the key sharing method in the prior art, in order to exclude one terminal from N terminals, the base station must perform (N−1) time the encryption and transmit (N−1) pieces of data. For example, the case will be considered where one terminal is excluded from 1000 terminals and then a new common secret key is shared with remaining 999 terminals. At this time, in the first and second examples in the prior art, the encryption process must be carried out 999 times and also 999 ciphertexts must be transmitted. At any rate, these operations put the heavy burden onto the base station side.

Further, normally the terminal has not so high computational capability since it must be implemented small in size at low cost. Such terminal must update the key at high speed. In the second example in the prior art, the terminal must perform the power residue calculation of long bit length to obtain the key. Such calculation puts the considerable burden onto the terminal which has not the high computational capability, so that the processing time becomes long until the key sharing can be achieved.

The present invention has been made in light of such points and it is an object of the present invention to achieve a key sharing method of sharing distributed key information with other terminals and a key sharing method of sharing the distributed key information only with particular terminals and having following features.

(1) An amount of communication from the base station to the terminal is small. An amount of data transmission at the base station is small. The service suspending term required until all terminals complete the key sharing is short.

(2) The terminal whose computational capability is not high can achieve the key sharing at high speed. The process in the terminal can be reduced.

In addition, an object of the present invention is to overcome the above problems in the prior art, and to achieve a key sharing method which is secure against the faking attack and the tampering attack by adding a signature function without increase in the communication amount. Also, an object of the present invention is to achieve a key sharing method which is secure against the adaptive chosen ciphertext attack on the basis of the Cramer-Shoup cipher.

However, three following problems exist in the above key sharing method.

(1) It is preferable that the secret information of the terminal should be updated periodically to improve the security. In this case, if the new secret information is distributed to terminal by terminal, an amount of communication and a time needed until the update is completed are increased. In addition, normally the update of the public information is also needed when the secret information are updated. Thus, since the public book and the public information which are saved locally in the terminals are updated, an update time is increased.

(2) In order to exclude continuously the terminals, which have been excluded in the preceding exclusive key sharing, in succeeding all exclusive key sharings, the excluding process is needed every exclusive key sharing.

(3) In order to execute the exclusive key sharing in the system consisting of only the terminal, either all terminals must hold the public information of other terminals or the public book for opening them publicly is needed. Besides, since any terminal can act as the chairman terminal, the method cannot correspond to the case where the chairman terminal must be fixed to a certain terminal in practical use.

In order to overcome the above subjects, the present invention intends to update the secret information in all terminals while suppressing an amount of communication and an update time to the lowest minimum, to exclude continuously the terminals which have been excluded once not to execute the process every exclusive key sharing, to enable each terminal not to hold the public information of all terminals and to eliminate the public book, and to allow only a certain terminal to be appointed as the chairman terminal.

Furthermore, the above exclusive key sharing method contains such a problem that the exponent part employed in the power residue calculation is assumed as about 160 bits and thus the calculation time is long.

In order to overcome further such problem, an object of the present invention is to reduce a size of the exponent part by executing collectively the inverse element calculation, which causes the extension of the exponent part, to thus perform the calculation at high speed in the exclusive key sharing method.

DISCLOSURE OF THE INVENTION

In order to overcome the above subjects, in the present invention, the exclusive key sharing method for the communication system which consists of the base station and N terminals connected to the base station to allow broadcast communication,

wherein the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, and the number of terminals which can be specified by the base station is 1,

respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy

S=Σλ(i, Λ)×Si (sum of iεΛ is calculated)

where Si=S+f₁×i modq (f₁ is a non-zero element of GF(q))

λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated)

Λ is a set of any two terminals out of the N terminals), the base station holds (S, p, g, S1, . . . , SN),

(1) the base station calculates preparatory information C1=g^(k) modp if the element of GF(p) is g and the non-zero element of GF(q) is k, and

(2) the base station calculates exclusive information C2=g{circumflex over ( )}(k×Sa modq) modp) based on the secret information Sa of the particular terminal a and then broadcasts it together with the particular terminal number a and the preparatory information C1 to all terminals,

(3) the base station calculates the common key K=g{circumflex over ( )}(k×S modq) modp) shared with all terminals j (j≠a) except the particular terminal a and

(4) respective terminals j (j≠a) calculate

C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C 2{circumflex over ( )}(λ(a, Λ) modq) modp

to thus obtain the common key K shared with the base station.

According to such configuration, since the key sharing can be achieved by broadcasting from the base station to all terminals, the service suspending term for the key sharing can be reduced and the process in the terminal can be reduced. Therefore, the terminal which has not high computational capability can achieve the key sharing at high speed.

Also, the exclusive key sharing method for the communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, and the particular terminal number which can be specified by the chairman terminal φ (to which any terminal can be appointed) d (1≦d≦N−1),

respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated)

Si=S+f ₁ ×i ¹ + . . . , +f _(d) ×i ^(d) modq

(where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use the public key of the system

y=g ^(s) modp,

public information

y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp,

the prime number p, the measure q, and the element g, and

(1) the chairman terminal generates arbitrarily the non-zero element k of GF(q) and then calculates exclusive information

C 2 _(i1) =y _(i1) ^(k) modp, . . . , C 2 _(id) =y _(id) ^(k) modp

based on the public information y_(i1), . . . , y_(id) of the d terminals i₁, . . . , i_(d),

(2) the chairman terminal calculates a signature

 Z=C 2 _(i1) × . . . ×C 2 _(id)×(−S _(φ))+k modq

by using own secret information S_(φ), and broadcasts the signature Z together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d) and own terminal number φ to all terminals,

(3) the chairman terminal calculates a common key

K=y ^(k) modp,

(4) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate

C 1=g ^(z) ×y _(φ){circumflex over ( )}(C 2 _(i1) × . . . ×C 2 _(id) modq) modp

(if a signer is surely the chairman terminal φ and also the signature Z, the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d), and the terminal number φ of the chairman terminal are not tampered, C1=g^(k) modp is calculated) by using the public information y, of the chairman terminal,

(5) the respective terminals j calculate λ(j, Λ) and λ(i₁, Λ), . . . , (i_(d), Λ) where Λ={j, i₁, . . . , i_(d)}, and calculate C1{circumflex over ( )}(S_(j)×λ(j, Λ) modq)×C2 _(i1){circumflex over ( )}(λ(i₁, Λ) modq)× . . . ×C2 _(id){circumflex over ( )}(λ(i_(d), Λ) modq) modp by using the C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j) to thus obtain the common key K.

According to such configuration, only the particular terminal can be excluded by a small amount of communication, other terminals can share the distributed key information, and the distributed key information can be shared with the particular terminals only.

Moreover, in order to overcome the above subjects, in the present invention, the exclusive key sharing method for a communication system which consists of the base station and N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication is constructed such that the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, and the number of terminals which can be specified by the base station (referred to as the “particular terminal number” hereinafter) is 1,

respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

(where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and

the base station holds (S, p, g, S₁, . . . , S_(N)),

(1) the base station calculates preparatory information

C 1=g ^(k) modp

where an element of GF(p) is g and a non-zero element of GF(q) is k,

(2) the base station calculates exclusive information

C ₂ =g{circumflex over ( )}(k×S _(a) modq) modp,

based on the secret information S_(a) of the particular terminal a, and broadcasts the exclusive information together with the particular terminal number a and the preparatory information C₁ to all terminals, and

(3) the base station calculates a common key

K=g{circumflex over ( )}(k×S modq) modp

which is shared with all terminals j (j≠a) except the particular terminal a,

(4) the respective terminals j (j≠a) calculate a product

C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C ₂{circumflex over ( )}(λ(a, Λ) modq) modp

of a power residue value of C₁

C ₁{circumflex over ( )}(S _(j) ×λ( j, Λ) modq) modp

which uses a product of S_(j) and λ(j, Λ) to the modulus q as an exponent and a power residue value of C₂

C ₂{circumflex over ( )}(λ(a, Λ) mod q) modp

which uses λ(a, Λ) calculated to the modulus p as the exponent by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain the common key K which is shared with the base station, and

(i) the base station generates arbitrarily the non-zero element e of GF(q), and broadcasts the e to all terminals,

(ii) the base station calculates the new element

g′=g ^(1/e modq) modp

and replaces it with the managed element g,

(iii) the respective terminals i calculate the new secret information

S _(i) ′=S _(i) ×e modq

(at this time, (g′)^(Si′) modp=(g)^(Si) modp is satisfied).

According to such configuration, since an amount of communication required for the base station is small such as the e and the public information other than the system parameter element g are not changed, such an advantage can be achieved that update of the secret information can be performed at high speed.

Also, the exclusive key sharing method for the communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that

(i) the system manager generates arbitrarily the non-zero element e of GF(q), and broadcasts the e to all terminals,

(ii) the system manager calculates the new element

g′=g ^(1/e modq) modp

and replaces the managed element g with it, and

(iii) the respective terminals i calculate the new secret information

S _(i) ′=S _(i) ×e modq

(at this time, (g′)^(Si′) modp=(g)^(Si) modp is satisfied).

According to such configuration, since an amount of communication required for the system manager is small such as the e and the public information other than the system parameter element g are not changed, such an advantage can be achieved that update of the secret information can be performed at high speed.

Also, the exclusive key sharing method for the communication system which consists of the base station and the N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication is constructed such that

(i) the base station generates arbitrarily the non-zero element e of GF(q), and broadcasts the encrypted e encrypted by using the common key K to all terminals,

(ii) the base station calculates the new element

g′=g ^(1/e modq) modp

and replaces it with the managed element g, and

(iii) the respective terminals i decrypt the encrypted e by using the common key K, and calculate the new secret information

S _(i) ′=S _(i) ×e modq

According to such configuration, since the secret information of the terminals can be updated by using the random number which is distributed using the common key which is shared by the exclusive key sharing, the excluded terminal cannot be restored in the succeeding exclusive key sharing.

Also, the exclusive key sharing method for a communication system which consists of the N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that

(i) the chairman terminal generates arbitrarily the non-zero element e of GF(q), and broadcasts the encrypted e which is encrypted by using the common key K to all terminals,

(ii) the chairman terminal calculates the new element

g′=g ^(1/e modq) modp

and replaces it with the element g,

(iii) the respective terminals j decrypt the encrypted e by using the common key K, and calculate the new secret information

S _(i) ′=S _(i) ×e modq

According to such configuration, since the secret information of the terminals can be updated by using the random number which is distributed using the common key which is shared by the exclusive key sharing, the excluded terminal cannot be restored in the succeeding exclusive key sharing.

Also, the exclusive key sharing method for the communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, elements of GF(p) are g, and the particular terminal number which can be specified by the chairman terminal b is 1,

respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

(where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and

the chairman terminal b can use the public key for all terminals

y=g ^(S) modp

and the public information

y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp,

(1) the chairman terminal b generates the non-zero element k of GF(q), and calculates the preparatory information

C ₁ =g ^(k) modp,

(2) the chairman terminal b calculates the exclusive information

C ₂ =y _(a) ^(k) modp

based on the public information y_(a) of the particular terminal a, and broadcasts the exclusive information together with the particular terminal number a and the preparatory information C₁ to all terminals, and

(3) the chairman terminal b calculates the common key

K=y ^(k) modp,

(4) the respective terminals j (j≠a, b) calculate λ(j, Λ) and λ(a, Λ) where Λ={j, a}, and calculate

C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C ₂{circumflex over ( )}(λ(a, Λ) modq) modp

by using the preparatory information C₁, the exclusive information C₂, and own secret information S, to thus obtain the common key K.

According to such configuration, since the terminals except the chairman terminal are not requested to hold the public information of other terminals and only the chairman terminal can use the public information of other terminals, such an advantage can be achieved that other terminals cannot be designated as the chairman terminal.

Further, in order to overcome the above subjects, in the present invention, the exclusive key sharing method for the communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, elements of GF(p) are g, and the particular terminal number which can be specified by the chairman terminal φ is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i)

(where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any (d+1) terminals out of the N terminals), the respective terminals i and the chairman terminal φ can use the public key of the system

y=g ^(S) modp,

the public information

y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp,

and the p, q, and g,

(1) the chairman terminal calculates the preparatory information

C 1=g ^(k) modp (k is a non-zero element of GF(q)),

(2) the chairman terminal calculates the exclusive information

C 2 _(i1) =y _(i1){circumflex over ( )}(k×λ(i ₁, α) modq) modp, . . . , C 2 _(id) =id{circumflex over ( )}(k×λ(i _(d), α) modq) modp

based on a set α of the d particular terminals i₁, . . . , i_(d), λ(i₁, α), . . . , λ(i_(d), α), and the public information y_(i1), . . . , y_(i1), and broadcasts the exclusive information C2 _(i1), . . . , C2 _(id) together with the preparatory information C1 and the particular terminal number i₁, . . . , i_(d) to all terminals, and

(3) the chairman terminal calculates the common key

K=y ^(k) modp,

(4) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate

λ(j, Λ _(j)), λ(i ₁ , {j, i ₁}), . . . , λ(i _(d) , {j, i _(d)}), j where Λ _(j) ={j, i ₁ , . . . , i _(d)} and

T _(j)={Π(j−L)}/(product of LεΛ−{i} is calculated),

and calculate cession keys

K _(i) =C 1{circumflex over ( )}(S _(j)×λ(j, Λ_(j))×T_(j) modq)×C 2 _(i1){circumflex over ( )}(λ(i ₁ , {j, i ₁})×T _(j) modq)× . . . ×C 2 _(id){circumflex over ( )}(λ(i _(d) , {j, i _(d)})×T _(j) modq) modp

by using the preparatory information C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j), and calculates

K _(j){circumflex over ( )}(1/T _(j) modq) modp

to thus obtain the common key.

According to such configuration, the operation can be performed at high speed by reducing a size of the exponent part and thus the key sharing can be implemented at high speed. Also, since the chairman terminal bears the calculation of the terminal side, respective terminals can perform the key sharing at high speed.

In the present invention, higher speed of the exclusive key sharing method is intended by using the following approach. Expansion in size of the modulus due to the inverse element of the exponent part can be prevented by calculating collectively the inverse elements of the exponent part in the power residue calculation of the exclusive information of respective terminals in the key sharing at the end. The same values exist as the coefficient concerning the excluded terminal number in the exponent part in the power residue calculation of the exclusive information executed by respective terminals in the key sharing. Therefore, the exponent part in the key sharing can be reduced if the base station or the chairman terminal calculates previously this value into the power residue value in the exclusive information.

There is the case where a negative value of the exponent part is present in the power residue calculation of the exclusive information performed by the respective terminals at the time of key sharing. In this case, the exponent part is expanded up to the size of the modulus even by the above countermeasure. Therefore, in the case of the negative exponent part, the reduction effect can also be achieved if the respective terminals calculate in advance the inverse elements of the exclusive information and then power-residue-calculate the absolute value of the exponent part into the inverse elements of the exclusive information.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a view showing a set-up phase in a key sharing method according to a first embodiment of the present invention;

FIG. 2 is a view showing a preparatory phase in the key sharing method according to the first embodiment;

FIG. 3 is a view showing a key sharing phase in the case where a key is shared with all terminals except a terminal 5, in the key sharing method according to the first embodiment;

FIG. 4 is a view showing a configuration of respective terminals and a base station in the key sharing method according to the first embodiment;

FIG. 5 is a view showing a key sharing phase in the case where a key is shared with terminals which do not exceed a half of all terminals, in the key sharing method according to the first embodiment;

FIG. 6 is a view showing a key sharing phase in the case where a common key is shared with all terminals except particular terminals 4 and 5, in the key sharing method according to a second embodiment of the present invention;

FIG. 7 is a view showing a set-up phase in a key sharing method according to a third embodiment of the present invention;

FIG. 8 is a view showing a preparatory phase in the key sharing method according to the third embodiment;

FIG. 9 is a view showing a key sharing phase in the key sharing method according to the third embodiment;

FIG. 10 is a view showing a set-up phase in a key sharing method according to a fourth embodiment of the present invention;

FIG. 11 is a view showing a preparatory phase in the key sharing method according to the fourth embodiment;

FIG. 12 is a view showing a key sharing phase in the case where a key is shared with all terminals except a terminal 5, in the key sharing method according to the fourth embodiment;

FIG. 13 is a view showing a set-up phase in a key sharing method according to a fifth embodiment of the present invention;

FIG. 14 is a view showing a preparatory phase in the key sharing method according to the fifth embodiment;

FIG. 15 is a view showing a key sharing phase in the case where a key is shared with all terminals except a terminal 5, in the key sharing method according to the fifth embodiment;

FIG. 16 is a view showing a normal condition in a key sharing method according to a sixth embodiment of the present invention;

FIG. 17 is a view showing a method of updating an element g in the key sharing method according to the sixth embodiment;

FIG. 18 is a view showing a method of updating a secret key in the key sharing method according to the sixth embodiment;

FIG. 19 is a view showing a normal condition in a key sharing method according to a seventh embodiment of the present invention;

FIG. 20 is a view showing a method of updating an element g in the key sharing method according to the seventh embodiment;

FIG. 21 is a view showing a method of updating a secret key in the key sharing method according to the seventh embodiment;

FIG. 22 is a view showing a state where a terminal 3 is excluded in a key sharing method according to an eighth embodiment of the present invention;

FIG. 23 is a view showing a method of distributing a random number in a key sharing method according to the eighth embodiment;

FIG. 24 is a view showing a method of excluding continuously the terminal in the key sharing method according to the eighth embodiment;

FIG. 25 is a view showing a state where a terminal 3 is excluded in a key sharing method according to a ninth embodiment of the present invention;

FIG. 26 is a view showing a method of distributing a random number in a key sharing method according to the ninth embodiment;

FIG. 27 is a view showing a method of excluding continuously the terminal in the key sharing method according to the eighth embodiment;

FIG. 28 is a view showing a method of fixing a chairman terminal in a key sharing method according to a tenth embodiment of the present invention;

FIG. 29 is a view showing a key sharing method according to the first example in the prior art;

FIG. 30 is a view showing a key sharing method according to the second example in the prior art;

FIG. 31 is a view showing a set-up phase in a key sharing method according to an eleventh embodiment of the present invention;

FIG. 32 is a view showing a preparatory phase in the key sharing method according to the eleventh embodiment; and

FIG. 33 is a view showing a key sharing phase in the key sharing method according to the eleventh embodiment.

BEST MODES FOR CARRYING OUT THE INVENTION

Embodiments of the present invention will be explained in detail with reference to FIG. 1 to FIG. 28 and FIG. 31 and FIG. 33 hereinafter.

(First Embodiment)

A first embodiment of the present invention is an exclusive key sharing method in which, in a system consisting of a base station and five terminals, the base station broadcasts preparatory information (g^(k) modp), exclusive information (g^(kS5) modp), a ciphertext (M×K modp) and the excluded terminal number (5) to respective terminals by using secret information Si which are generated by distributing a secret key S by the secret distribution method, while respective terminals calculates a product of Ci{circumflex over ( )}(λ(i, Λ) modq) modp and C2{circumflex over ( )}(λ(5, Λ) modq) modp to obtain K and then calculate M by dividing the ciphertext (M×K modp) by K to obtain common data to the base station 0, whereby other terminals except the terminal 5 can share the key with the base station.

FIG. 1 is a view showing a set-up phase in a key sharing method according to the first embodiment of the present invention. In FIG. 1, 0 denotes the base station, and 1 to 5 denotes terminals which are managed by the base station. 15 denotes a storing portion in the base station, and 7 to 11 are storing portions in respective terminals, which cannot be observed and tampered from the outside.

FIG. 2 is a view showing a preparatory phase according to the first embodiment of the present invention.

FIG. 3 is a view showing a key sharing phase in the case where the key is shared with all terminals 1, . . . , 4 except the terminal 5.

FIG. 4 is a view showing a configuration of the base station and respective terminals i (1≦i≦N) in the key sharing method according to the first embodiment.

FIG. 4(a) is a block diagram of the terminal. In FIG. 4(a), 20 denotes a receiver portion for receiving data from the base station; 21, a first terminal side storing portion for holding moduli p, q and a base g; and 22, a second terminal side storing portion for holding secret information Si. Also, 23 denotes a first terminal side calculating portion for calculating the common key K based on preparatory information C1 and exclusive information C2 distributed from the base station in the key sharing phase, and 24 denotes a second terminal side calculating portion for calculating common data M based on a ciphertext C3 distributed from the base station and K. FIG. 4(b) is a block diagram of the base station. In FIG. 4(b), 25 denotes a first base station side storing portion for holding the moduli p, q, the base g, and an integer k; 26, a second base station side storing portion for holding public information y1, . . . , y5 of respective terminals; and 27, a third base station side storing portion for storing the common data M and the public key y of all terminals. Also, 28 denotes a first base station side calculating portion for calculating the preparatory information C1; 29, a second base station side calculating portion for calculating the exclusive information C2; and 30, a third base station side calculating portion 30 for calculating the common key K and calculating the ciphertext C3 based on the common key K and the common data M. Also, 31 denotes a controlling portion for selecting public information based on the particular terminal number and then transmitting the particular terminal number to a transmitting portion 32, and 32 denotes a transmitting portion for broadcasting the preparatory information, the exclusive information, the ciphertext, and the particular terminal number to all terminals.

FIG. 5 is a view showing a key sharing phase in the case where key sharing is performed only by the particular terminals.

The key sharing method according to the first embodiment of the present invention is classified into three phases, i.e., set-up phase, preparatory phase, and key sharing phase. The case where the base station manages five terminals will be explained every phase hereunder.

The set-up phase in the key sharing method according to the first embodiment of the present invention will be explained with reference to FIG. 1 hereunder. The base station 0 formulates the secret key S and holds it in secret. The base station formulates a prime number p which is larger than the secret key S and 6 or a power number p of the prime number and holds it, and calculates one measure q of (p−1) and holds it, and calculates a non-zero element f1 of GF(q).

The base station distributes in secret the secret information Si, which are formulated by calculating Si=f(i) by using

f(z)=S+f 1×z modq,

to respective terminals i (1≦i≦5) via the cipher communication means.

Suppose that Λ is a set of any two terminals out of five terminals, the secret information Si can satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated.

Where the set Λ−{i} is a set which is obtained by subtracting a set {i} from a set Λ. For example, if Λ={1, 2} is assumed, $\begin{matrix} {{\lambda \left( {1,\Lambda} \right)} = {\Pi \left\{ {L/\left( {L - i} \right)} \right\} \left( {L \in \left\{ 2 \right\}} \right)}} \\ {= {{2/\left( {2 - 1} \right)} = 2}} \\ {{\lambda \left( {2,\Lambda} \right)} = {\Pi \left\{ {L/\left( {L - 2} \right)} \right\} \left( {L \in \left\{ 1 \right\}} \right)}} \\ {= {{1/\left( {1 - 2} \right)} = {- 1}}} \\ {\Sigma \quad {\lambda \left( {i,\Lambda} \right)} \times {{Si}\left( {i \in \Lambda} \right)}} \\ {= {{{\lambda \left( {1,\Lambda} \right)} \times {S1}} + {{\lambda \left( {2,\Lambda} \right)} \times {S2}}}} \\ {= {{2 \times {f(1)}} - {f(2)}}} \\ {= {{2 \cdot \left( {S + {f1}} \right)} - \left( {S + {2 \cdot {f1}}} \right)}} \\ {= S} \end{matrix}$

can be calculated.

The respective terminals 1, . . . , 5 hold the secret information Si in storing portions 7, . . . , 11. The base station 0 holds the modulus p, the element g of GF(p) in a storing portion 6. The base station 0 calculates public information y1 (=g^(S1) modp), y2 (=g^(S2) modp), . . . , y5 (=g^(S6) modp), which use the secret information S₁, . . . , S₆ as exponents respectively, p as the modulus, and g as the base, and then holds them in the storing portion 6. The secret information S₁, . . . , S₆ are cleared from the base station after the calculation. The base station 0 calculates the public keys y (=g^(S) modp) of all terminals, which use the secret key S of all terminals 1, . . . , 5 as the exponent, p as the modulus, and g as the base, and then holds them in the storing portion 6. The secret key S is cleared from the base station after the calculation.

The preparatory phase in the first embodiment of the present invention will be explained with reference to FIG. 2 hereunder. The base station 0 generates arbitrarily a non-zero element k of GF(q), and calculates the preparatory information C1 (=g^(k) modp) which uses k as the exponent, p as the modulus, and g as the base. The base station calculates the exclusive information C2 (=y₅ ^(k) modp), which uses the integer k as the exponent, p as the modulus, and the public information y₅ of the terminal 5 specified by the base station 0 as the base. The base station calculates the common key K (=y^(k) modp=g{circumflex over ( )}(S×k) modp), which uses the integer k as the exponent, p as the modulus, and the public key y of all terminals 1, . . . , 5 as the base. At the same time, the base station generates common data M to all terminals j (j=1, . . . , 4) except the particular terminal 5, and then calculates the ciphertext C3 (=M×K modp) which is a product of M and K to the modulus p. The base station broadcasts the preparatory information C₁, the exclusive information C₂, the ciphertext C3 and the particular terminal number 5 to all terminals.

The key sharing phase executed in the case where all terminals 1, . . . , 4 except the terminal 5 share the common key will be explained with reference to FIG. 3 hereunder. The terminal 1 calculates

λ(1, Λ)=5/(5−1)=5/4

λ(5, Λ)=1/(1−5)=−1/4

where Λ={1, 5} based on own terminal number 1 and the excluded terminal number 5 which has been received. The terminal 1 calculate a product ${{C1}\hat{}\left( {{S1} \times {\lambda \left( {1,\Lambda} \right)}\quad {mod}\quad q} \right)} \times {{C2}\hat{}\left( {{\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p$ $\begin{matrix} {= {{g\hat{}\left( {k \times {S1} \times {\lambda \left( {1,\Lambda} \right)}\quad {mod}\quad q} \right)} \times {g\hat{}\left( {k \times {S5} \times {\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \\ {= {{g\hat{}\left( {k \times \left( {{{S1} \times {\lambda \left( {1,\Lambda} \right)}} + {{S5} \times {\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q}} \right)} \right)}\quad {mod}\quad p}} \\ {= {{g\hat{}\left( {k \times S\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \\ {= K} \end{matrix}$

of a power residue value

C 1{circumflex over ( )}(λ(1, Λ) modq) modp

which uses a product of Si and λ(1, Λ) as an exponent and C1 as the base and a power residue value

C 2{circumflex over ( )}(λ(5, Λ) modq) modp

which uses λ(5, Λ) as the exponent and C2 as the base, by using the preparatory information C1 (=g^(k) modp) and the exclusive information C2 (=y₅ ^(k) modp) to thus obtain the common key K. In addition, the terminal 1 calculates a value

 C 3/K=M×K/K modp=M,

which is derived by dividing the ciphertext C3 (=M×K modp) by K to the modulus P, as the common data to the base station 0.

The terminals 2 to 4 can also perform the above calculations similarly. As a result, the terminals 1 to 4 can share the common key K.

In contrast, the terminal 5 cannot decide that the exclusive information C2 (=y₅ ^(k)=g{circumflex over ( )}(k×S5) modp) which is broadcasted from the base station 0 is equal to the power residue value (=C1 ^(S5) modp=g{circumflex over ( )}(k×S5 modp) which can be calculated based on the held information, and also cannot calculate λ(5, Λ) because of Λ={5}. Therefore, the terminal 5 cannot calculate the common key K in the above key sharing phase. As a result, the terminal 5 cannot calculate the common data M.

Since the respective terminals cannot calculate the secret key S based on

K=g{circumflex over ( )}(S×k) modp,

C 1=g ^(k) modp, and

y=g ^(S) modp,

respective divided secret information S_(a) can be reused. For this reason, the set-up is not needed in the following key sharing and thus merely the preparatory phase and the key sharing phase must be repeated.

The configuration of the base station and the respective terminals i (1≦i≦N) employed to execute the above process is shown in FIG. 4.

Next, explanation of the security in the first embodiment will be made hereunder.

(1) It is difficult for all terminals to calculate the common key K in the preparatory phase. In the preparatory phase, information held by the terminal 1, for example, are two following information,

secret information: S1

preparatory information: C1 (=g^(k) modp)

In order to calculate the common key K based on the above information, the secret key S should be calculated from S. However, since the secret key S of all terminals are divided by using the Shamir threshold method (please see Menezes, van Oorschot, Vanstone, “HANDBOOK OF APPLIED CRYPTOGRAPHY”, CRC Publishing Co. concerning details of the Shamir threshold method), the secret key S cannot be calculated based on S1. In this case, the size of the secret key S of all terminals must be set to the large number to such extent that it is secure against round robin attack.

(2) It is difficult for the excluded terminal 5 to calculate the common key K and the common data M in the key sharing phase. Information held by the terminal 5 excluded in the key sharing phase are

exclusive information: C2 (=y^(S5)=g{circumflex over ( )}(k×S5) modp)

ciphertext: C3 (=M×K=M×g{circumflex over ( )}(k×S) modp)

in addition to the above (1). These are equal to the ciphertext in the ElGamal cipher. Accordingly, if the moduli p, q and the integer k are set sufficiently large, this ciphertext results in the ElGamal cipher and thus it becomes difficult to calculate the common key K and the common data M based on them. More particularly, it is preferable that p should be set to 1024 bits or more and k, q be set to 160 bits or more.

In the preparatory phase after the key sharing has been completed while excluding the terminal 5, it is possible to exclude the terminal 5 continuously. This is the case that, for example, during when the cipher communication is carried out by five terminals which can share the common secret key in the group, first the terminal 5 is lost or robbed and then four remaining terminals share a new common secret key correspondingly.

Then, if the terminal 4 is also lost or robbed, remaining terminals must share a next common key while excluding both the terminals 4, 5. For this purpose, in the key sharing preparatory phase after the terminal 5 has been excluded, the base station and the terminals 1 to 3 formulate new common data M′ (simply an exclusive logical sum of M1 and M2 may be calculated, or a Hash value of a sum of M1 and M2 may be calculated by using the Hash function) based on the common data M1 used in excluding the terminal 5 and the common data M2 used in excluding the terminal 4. According this method, the terminal 5 which cannot obtain the common data M1 and the terminal 4 which cannot obtain the common data M2 cannot formulate the new common data M′. Similarly, the preparatory information, the exclusive information, and the ciphertext, which are used to share the common data M2, may be distributed in secret by using the common data M1. According this method, the terminal 5 which cannot obtain the common data M1 and the terminal 4 cannot obtain the common data M4.

Also, in case the terminals 4, 5 conspire with each other to obtain the new common data M′, there is such a method that, in the key sharing phase in excluding the terminal 4 after the terminal 5 has been excluded, the exclusive information C2 corresponding to the terminal 5 is also distributed and then the terminals 1 to 3 share the new common data. This method is substantially identical to a method explained in a second embodiment.

In the first embodiment, the case where remaining terminals except any one terminal share the common key in the system consisting of the base station and five terminals is discussed. But the number of terminals may be set to any integer.

The secret information Si which is obtained by calculating Si=f(i) by using the above f(z)=S+f1×z modp may be utilized as the secret information of respective terminals i. Also, the number of excluded terminals may also be set to any integer. For example, if, the number of excluded terminals is set to d, the secret information Si which is obtained by calculating Si=f(i) by using

f(z)=S+f 1×z 1+f 2×z 2+ . . . +fd×zd modp

may be utilized as the secret information of respective terminals i.

In the first embodiment, the base station divides the secret information Sa of respective terminals and then distributes it via the cipher communication means. However, the trusted third party other than the base station and the terminals may conduct these operations, otherwise the secret information Sa may be allocated previously to the terminals without distribution.

In addition, the cipher communication means using either the secret key cipher or the public key cipher may be employed. In this case, if the public key cipher is used, the security against the illegality of the base station can be improved since the base station holds only the public keys of respective terminals.

If a digital signature of the base station is added to all data distributed from the base station to the respective terminals, the terminals can authenticate the base station and detect the tampering by the third party, so that the security can be improved.

Besides, in order to decide whether or not the secret information Sa of respective terminals is properly divided in the first embodiment, Pedersen's share verification protocol (see the preprint “Distributed Provers with Applications to Undeniable Signature”, T. P. Pedersen, Proc. of Eurocrypt' 91, Springer-Verlag) can be applied. If the secret acceptors open publicly verification information {g^(S) modp, g^(f1) modp, . . . , g^(fd) modp}, respective terminals can check the validity of own secret information and thus the security can be improved.

In the above, the base station distributes the secret information Sa of respective terminals in secret to respective terminals by using the cipher communication means and also distributes the preparatory information C1 to respective terminals. However, the base station may calculate C1 ^(Sa) modp and then distributes them in secret to respective terminals via the cipher communication means. Since respective terminals cannot directly know Sa by this method, the terminals cannot calculate S even if they are in collusion with each other. However, in this case, the set-up must be performed every key sharing.

Although the base station distributes the exclusive information C2 to exclude the terminal 5 in the key sharing phase, such base station may calculate C2{circumflex over ( )}(═(5, Λ) modq) modp and distribute them. According to this method, computational complexity in the terminal can be reduced extremely but an amount of communication is increased since Λ is different every terminal.

Although the ElGamal cipher-based method is implemented in the first embodiment, a method may be implemented on the basis of the Nyberg-Rueppel signature. According to this method, the terminals can verify the digital signature of the base station applied to the common data M. As for details of the Nyberg-Rueppel signature, please see Menezes, van Oorschot, Vanstone, “HANDBOOK OF APPLIED CRYPTOGRAPHY” (CRC Publishing Co.). The Nyberg-Rueppel signatures of six types (much more types if positive and negative are considered) have been proposed according to the configuration of the method. All six types can be applied to the present invention.

Further, the base station holds the public information y1, . . . , y5 of respective terminals. However, if the base station can be trusted, it may hold the secret information S1, . . . , S5 in place of the public information.

Furthermore, in the first embodiment, the common data M is employed as the common key. Alternatively, the common key itself may be utilized as the common key between the base station and the terminals.

Moreover, if the terminal is newly incorporated into the system in which the set-up has been completed like the first embodiment, the secret information may be calculated by using the new terminal number and then this secret information may be distributed in secret to the new terminal.

Besides, in the first embodiment, one piece of secret information is held in every terminal. But it is possible to change the authority every terminal by adjusting the number of the secret information in response to the strength of the authority of the terminal. For example, such a method can be employed that the terminals which hold only one secret information cannot share the key, whereas the terminals which hold more than two secret information can share the key.

Also, in the first embodiment, the difficulty of the discrete logarithm problem to the finite field GF(p) is employed. Normally this can be extended to the discrete logarithm problem on the elliptic curve to any finite field (field of definition). In this case, since the bit number of the field of definition can be reduced to about 160 bits, for example, data communication amount and a size of the storing area in the terminal or the base station can be reduced.

If first, second, and third base station side storing portions of the base station and first, second, and third terminal side storing portions of the terminal are constructed as areas which cannot be observed nor changed, the base station, the user of the terminals, and the third party cannot observe nor change the secret information and thus the security can be improved. If the terminals are in collusion with each other, it is difficult for them to calculate the secret key S of all terminals.

Although the key sharing is conducted to exclude the particular terminal in the first embodiment, conversely such a method that the base station can share the key only with the particular terminal will be explained hereunder. In this method, the same infra as that in the first embodiment can be employed. If the key sharing method in the first embodiment and a following key sharing method may be switched automatically according to a size of the group, the base station can perform the key sharing effectively unconsciously. FIG. 5 shows the key sharing phase in the method in which only the particular terminals can share the key.

The base station 0 calculates common information X1 (=y2 ^(k) modp) and X2 (=y1 ^(k) modp) which use the public information y1 and y2 of the particular terminals 1 and 2 as the base, p as the modulus, and k as the exponent and broadcasts the common information X1, X2 together with the preparatory information C1 (=g^(k) modp) to all terminals 1, . . . , 5.

The base station 0 calculates the common key $\begin{matrix} {K = \left( {{y1} \times {y2}} \right)^{k}} \\ {= {{g\hat{}\left( {k \times \left( {{S1} + {S2}} \right)\quad {mod}\quad q} \right)}\quad {mod}\quad {p.}}} \end{matrix}$

which uses the integer k as the exponent, and a product of y1 and y2 as a base by using the public information y1, y2 of the particular terminals 1, 2.

The particular terminal 1 calculates a product

C 1 ^(S1) ×X 1=g{circumflex over ( )}(k×(S 1+S 2) modq) modp

of the power residue value, which uses p as the modulus and the preparatory information C1 as the base and the secret key S1 as the exponent, and the common information X1 to thus obtain the common key K. According to this method, the particular terminal 2 can calculate the common key K by the similar calculation. Since the set-up phase and the preparatory phase of the system are similar to those in the first embodiment, the key sharing method in the first embodiment and the particular terminals may be switched according to the number of particular terminals in the key sharing phase.

As described above, according to the first embodiment of the present invention, the exclusive key sharing method in the system consisting of the base station and five terminals is constructed such that the base station broadcasts preparatory information (g^(k) modp), exclusive information (g^(kS5) modp), a ciphertext (M×K modp) and the excluded terminal number (5) to respective terminals by using secret information Si which are generated by distributing a secret key S by the secret distribution method, while respective terminals calculates a product of Ci{circumflex over ( )}(λ(i, Λ) modq) modp and C2{circumflex over ( )}(λ(5, Λ) modq) modp to obtain K and then calculate M by dividing the ciphertext (M×K modp) by K to obtain common data to the base station 0, whereby other terminals except the terminal 5 can share the key with the base station. Therefore, other terminals except the terminal 5 can share the key with the base station in small communication amount at high speed.

(Second Embodiment)

A second embodiment of the present invention is an exclusive key sharing method in which, in a system consisting of a base station and five terminals, the base station broadcasts the preparatory information (g^(k) modp), the exclusive information (y4 ^(k) modp, y5 ^(k) modp), the ciphertext (M×K modp) together with the particular terminal numbers (4, 5) to all terminals, while respective terminals calculates g{circumflex over ( )}(k×S1×λ(1, Λ) modq)×g{circumflex over ( )}(S4×k×λ(4, Λ) modq)×g{circumflex over ( )}(S5×k×λ(5, Λ) modq) modp to obtain K and then divide it by the ciphertext K to obtain common data M to the base station, whereby other terminals except the terminal 4 and the terminal 5 can share the key with the base station.

FIG. 6 is a view showing a key sharing phase executed in the case where the common data are shared with all terminals 1, 2, 3 except the particular terminals 4 and 5, in the key sharing method according to the second embodiment of the present invention. The set-up phase and the preparatory phase in the second embodiment of the present invention are similar to those in the first embodiment.

The key sharing phase executed in the case where common data are shared with all terminals 1, 2, 3 except the particular terminals 4 and 5 will be explained with reference to FIG. 6 hereunder. The base station 0 broadcasts the preparatory information C1 (=g^(k) modp) which uses k as the exponent, p as the modulus, and g as the base, the exclusive information C24 (=y4 ^(k) modp) and C25 (=y5 ^(k) modp) which uses the integer k as the exponent, p as the modulus, and g as a base by using the public information y4, y5 of two particular terminals 4, 5, a ciphertext C3 (=M×K modp) which is a product of the common data M and the common key K to the modulus p together with the particular terminal numbers (=4, 5) to all terminals.

The terminal 1 calculates λ(1, Λ), λ(4, Λ), λ(5, Λ) where Λ={1, 4, 5}, then calculates a power residue value

${{{C1}\hat{}\left( {{S1} \times {\lambda \left( {1,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p} = {{g\hat{}\left( {k \times {S1} \times {\lambda \left( {1,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p}$

which uses a product of Sj and λ(j, Λ) to the modulus q as the exponent and the C1 as the base, by using the preparatory information C1 and the exclusive information C24, C25. Then, the terminal 1 calculates a power residue value ${{{C24}\hat{}\left( {{\lambda \left( {4,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p} = {{{{y4}\hat{}\left( {k \times {\lambda \left( {4,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p} = {{g\hat{}\left( {{S4} \times k \times {\lambda \left( {4,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p}}$

which uses λ(4, Λ) to the modulus q as the exponent and the C24 as the base, by using the exclusive information C24. Also, the terminal 1 calculates a power residue value ${{{C25}\hat{}\left( {{\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p} = {{{{y5}\hat{}\left( {k \times {\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p} = {{g\hat{}\left( {{S5} \times k \times {\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p}}$

which uses λ(4, Λ) to the modulus q as the exponent and the C24 as the base, by using the exclusive information C24. Then, the terminal 1 calculates a product of them $\begin{matrix} {{{C1}\hat{}\left( {{S1} \times \quad {\lambda \left( {1,\Lambda} \right)}\quad {mod}\quad q} \right)} \times {{C24}\hat{}\left( {{\lambda \left( {4,\Lambda} \right)}\quad {mod}\quad q} \right)} \times} \\ {{{C25}\hat{}\left( {{\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p} \\ {= {{g\hat{}\left( {k \times {S1} \times {\lambda \left( {1,\Lambda} \right)}\quad {mod}\quad q} \right)} \times {g\hat{}\left( {{S4} \times k \times {\lambda \left( {4,\Lambda} \right)}\quad {mod}\quad q} \right)} \times}} \\ {{g\hat{}\left( {{S5} \times k \times \lambda \quad \left( {5,\Lambda} \right)\quad {mod}\quad q} \right)}\quad {mod}\quad p} \\ {= {{{g\hat{}\left( {{k \times \left( {{{S1} \times {\lambda \left( {1,\Lambda} \right)}} + {{S4} \times {\lambda \left( {4,\Lambda} \right)}\quad {mod}\quad q}} \right)} + {{S5} \times {\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q}} \right)}\quad {mod}\quad p} = {{g\hat{}\left( {k \times S\quad {mod}\quad q} \right)}\quad {mod}\quad p}}} \end{matrix}$

to obtain K. In addition, the terminal 1 calculates a value

C 3/K modp=M×K/K modp=M

which is obtained by dividing the ciphertext C3 by K to the modulus p to obtain the common data M to the base station.

The terminals 2, 3 can also perform the above calculations similarly. As a result, the terminals 1 to 3 can share the common data M. The set-up phase is not needed in succeeding key sharing.

In contrast, the terminals 4, 5 cannot decide that the exclusive information C24(=y4 ^(k)=g{circumflex over ( )}(k×S4) modp), C25(=y5 ^(k)=g{circumflex over ( )}(k×S5) modp) which are broadcasted from the base station are equal to the power residue value (C1 ^(S4) modp=g{circumflex over ( )}(k×S4 modp, C1 ^(S5) modp=g{circumflex over ( )}(k×S5 modp) which can be calculated based on the held information, and also cannot calculate λ(4, Λ), λ(5, Λ) because of Λ={4,5}. Therefore, the terminals 4, 5 cannot calculate the common key K in the above key sharing phase.

As a result, the terminals 4, 5 cannot calculate the common data M.

Not only the predetermined number d of particular terminals but also any number of terminals can be excluded. The base station holds e sets of secret information which are obtained by dividing the secret key S to any e particular terminal numbers d1, . . . , de (e is an integer) respectively, while respective terminals hold the secret information corresponding to own terminal numbers out of respective sets.

If the base station performs the key sharing, it selects the particular terminal number dw (1≦w≦e) which is equal to the actual particular terminal number D from d1, . . . , de, then calculates the exclusive information by using the secret information divided to the selected particular terminal number dw, and then distributes it to all terminals. Thus, any terminals can be excluded if the number is within d.

In addition, if the actual particular terminal number D is smaller than the particular terminal number d, the secret key S of all terminals is divided into the number which is larger than the normal number by (d−1). The base station holds such SN+1, . . . , SN+d−1 which are in excess of the normal number as dummy secret information. According to this method, if the base station selects v (=d−D) pieces, which is difference between the actual particular terminal number D and the particular terminal number d, of secret information Sb1, . . . , Sbv from such SN+1, . . . , SN+d−1, then calculates the exclusive information, and then distributes them to all terminals excessively, it can exclude any terminals if they are within d. In the case of this method, the secret information can be reduced rather than the method which employs e sets of secret information corresponding to the d1, d2, . . . , de.

As described above, according to the second embodiment of the present invention, the exclusive key sharing method in the system consisting of the base station and five terminals is constructed such that the base station broadcasts the preparatory information (g^(k) modp), the exclusive information (y4 ^(k) modp, y5 ^(k) modp), the ciphertext (M×K modp) together with the particular terminal numbers (4,5) to all terminals, while respective terminals calculates g{circumflex over ( )}(k×S1×λ(1, Λ) modq)×g{circumflex over ( )}(S4×k×λ(4, Λ) modq)×g{circumflex over ( )}(S5×k×λ(5, Λ) modq) modp to obtain K and then divide it by the ciphertext K to obtain common data M to the base station, whereby other terminals except the terminal 4 and the terminal 5 can share the key with the base station. Therefore, other terminals except the terminal 4 and the terminal 5 can share the key with the base station in small communication amount at high speed.

(Third Embodiment)

A third embodiment of the present invention is an exclusive key sharing method in which, in a system consisting of six terminals, the preparatory information C1(g^(k) modp), the exclusive information C2(g^(kS5) modp), the ciphertext K(g^(kS) modp), and the excluded terminal number (5) are broadcasted from the chairman terminal to other terminals with use of the secret information Si, to which the secret key S is distributed by the secret distribution method, while respective terminals calculate C1{circumflex over ( )}(λ(i, Λ) modq)×C2{circumflex over ( )}(λ(5, Λ) modq) modp to obtain K, whereby the terminals except the terminal 5 can share a group key K.

FIG. 7 is a view showing a set-up phase in a key sharing method according to a third embodiment of the present invention. FIG. 8 is a view showing a preparatory phase in the key sharing method according to the third embodiment. FIG. 9 is a view showing a key sharing phase in the case where the common key is shared with all terminals except the terminal 5.

The key sharing method according to the third embodiment of the present invention is roughly classified into three phases, i.e., the set-up phase, the preparatory phase, and the key sharing phase. The case where the terminal 2 is appointed to the chairman and the terminals share the group key K to exclude the terminal 5 will be explained phase by phase.

The set-up of the key sharing method according to the third embodiment of the present invention will be explained with reference to FIG. 7. The chairman terminal formulates the secret key S and holds it in secret. The chairman terminal formulates the prime number p which is larger than the secret key S and the terminal number 6 or the power number p of the prime number and opens it publicly, and calculates one measure q of (p−1) and opens it publicly, and calculates an element g of GF(q) and opens it publicly.

The chairman terminal calculates a non-zero element f1 of GF(q) and holds it.

The chairman terminal distributes in secret the secret information Si, which are obtained by calculating S_(i)=f(i) by using

f(i)=S+f ₁ ×i modq,

to respective terminals i (1≦i≦6) via the cipher communication means.

Suppose that Λ is a set of any two terminals out of six terminals, the secret information Si can satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated.

Where the set Λ−{i} is a set which is obtained by subtracting a set {i} from a set Λ.

The respective terminals 1, . . . , 6 hold the secret information Siin storing portions.

The chairman terminal calculates the public information y1(=g^(S1) modp), y2(=g^(S2) modp), . . . , y6(=g^(S6) modp), which use the secret information S1, . . . , S6 as exponents respectively, p as the modulus, and g as the base, and then opens them publicly. The public information y1, y2, . . . , y6 may be saved locally in respective terminals, or may be put up on the public area on the network to which any terminal can access. After the calculation, the secret information S1, . . . , S6 are cleared from the chairman terminal. The chairman terminal calculates the public keys y(=g^(S) modp) of all terminals, which use the secret key S of all terminals 1, . . . , 6 as the exponent, p as the modulus, and g as the base, and then opens them publicly. After the calculation, the secret key S is cleared from the chairman terminal.

The preparatory phase in the third embodiment of the present invention will be explained with reference to FIG. 8 hereunder. The chairman terminal generates arbitrarily a non-zero element k of GF(q) and calculates the preparatory information C1(=g^(k) modp) which uses an integer k as the exponent, p as the modulus, and g as the base. The chairman terminal calculates the exclusive information C2(=y₅ ^(k) modp), which uses an integer k as the exponent, p as the modulus, and the public information y5 of the terminal 5 specified by the chairman terminal as the base. The chairman terminal broadcasts the preparatory information C1, the exclusive information C2, and the particular terminal number 5 to all terminals.

The key sharing phase executed in the case where all terminals 1, . . . , 4, 6 except the terminal 5 share the common key will be explained with reference to FIG. 9 hereunder. The chairman terminal calculates a group key

K=y ^(k) modp

by using the system public key y.

The terminal 1 calculate a product ${{{C1}\hat{}\left( {{S1} \times {\lambda \left( {1,\Lambda} \right)}\quad {mod}\quad q} \right)} \times {{C2}\hat{}\left( {{\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p} = {{{g\hat{}\left( {k \times {S1} \times {\lambda \left( {1,\Lambda} \right)}\quad {mod}\quad q} \right)} \times {g\hat{}\left( {k \times {S5} \times {\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p} = {{{g\hat{}\left( {k \times \left( {{{S1} \times {\lambda \left( {1,\Lambda} \right)}} + {{S5} \times {\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q}} \right)} \right)}\quad {mod}\quad p} = {{{g\hat{}\left( {k \times S\quad {mod}\quad q} \right)}\quad {mod}\quad p} = K}}}$

of a power residue value

C 1{circumflex over ( )}(λ(1, Λ) modq) modp

which uses a product of Si and λ(1, Λ) as an exponent and C₁ as the base and a power residue value

C 2{circumflex over ( )}(λ(5, Λ) modq) modp

which uses λ(5, Λ) as the exponent and C2 as the base, by using the preparatory information C1(=g^(k) modp) and the exclusive information C2(=y₅ ^(k) modp) to thus obtain the common key K.

The terminals 3 to 4, 6 can perform the above calculations similarly. As a result, the terminals 1 to 4, 6 can share the common key K.

In contrast, the terminal 5 cannot decide that the exclusive information C2(=y₅ ^(k)=g{circumflex over ( )}(k×S5) modp) which is broadcasted from the chairman terminal is equal to the power residue value (=C1 ^(S5) modp=g{circumflex over ( )}(k×S5 modp) which can be calculated based on the held information, and also cannot calculate λ(5, Λ) because of Λ={5}. Therefore, the terminal 5 cannot calculate the common key K in the above key sharing phase.

Since respective terminals cannot calculate the secret key S based on K, C1, and y, respective divided secret information Si can be reused. For this reason, the set-up is not needed in the following key sharing and therefore only the preparatory phase and the key sharing phase may be repeated.

In the event that the new subscription terminal is present, Si=f(i) may be distributed in secret to the new subscription terminal.

A method of updating periodically the common key will be explained hereunder. For example, if the third terminal tries to change its key, it generates the random number k to formulate C1 and then broadcasts it to other terminals. The chairman terminal formulates C2 which is employed to exclude the third terminal by using the public key y3 of the third terminal and then broadcasts it to other terminals. The terminals other than the third terminal can share the same key. The third terminal can calculate the common key to other terminals by using both the public key y of all terminals and the random number k generated by its own terminal. The broadcast key can be changed simultaneously if any terminal transmits above two information.

In other words, the key sharing proposer (terminal 3) performs the key sharing operation to exclude own terminal like the base station and finally own terminal itself generates the common key based on the public key of all terminals.

A method of grading the terminals will be explained hereunder. Suppose that each terminal among the terminals has the different authority according to its user and the chairman is present. It is intended to constitute the group consisting of only the chairmen and to limit the receiver based on the communication contents. As the particular method, this can be achieved by changing the number of share Si (weight) between the chairman terminal and other terminals.

For example, in the set-up phase, the chairman has two shares with a threshold value 3, while other terminals have one share with the threshold value 3 similarly. In the key sharing phase, the chairman formulates one dummy share and distributes the exclusive information. As a result, the chairman can share the key, but other terminals cannot share the key.

For another example, in the set-up phase, the chairman has three shares with a threshold value 4 and the vice-chairman has two shares with the threshold value 4, while other terminals have similarly one share with the threshold value 4. In the key sharing phase, the chairman formulates one dummy share and distributes the exclusive information. As a result, the chairman can share the key, but the vice-chairman and other terminals cannot share the key. If the chairman formulates two dummy shares and distributes the exclusive information, the chairman and the vice-chairman can share the key, but other terminals cannot share the key.

In the third embodiment, the chairman terminal generates the secret information and the public information of other terminals and distributes the exclusive information of other terminals. But any terminal may distribute the exclusive information. Such any terminal generates the exclusive information by using the public information of the excluded terminal, which is saved locally or acquired from the public area, and then distributes it.

As described above, in the third embodiment of the present invention, the exclusive key sharing method is constructed such that, in the system consisting of six terminals, the preparatory information C1(g^(k) modp), the exclusive information C2(g^(kS5) modp), the ciphertext K(g^(kS) modp), and the excluded terminal number (5) are broadcasted from the chairman terminal to other terminals with use of the secret information Si, to which the secret key S is distributed by the secret distribution method, while respective terminals calculate C1{circumflex over ( )}(λ(i, Λ) modq)×C2{circumflex over ( )}(λ(5, Λ) modq) modp to obtain K, whereby the terminals except the terminal 5 can share a group key K. Therefore, in the system consisting of no base station, other terminals except the terminal 5 can share the key with the base station in small communication amount at high speed.

(Fourth Embodiment)

A fourth embodiment of the present invention is an exclusive key sharing method in which, in a communication system consisting of six terminals connected mutually to allow broadcast communication, the chairman terminal broadcasts a signature together with the exclusive information, the particular terminal number, and own terminal number to all terminals, while respective terminals check that a signer is surely the chairman terminal and also the signature, the exclusive information, the particular terminal numbers, and the chairman terminal number are not tampered and then calculate the common key by using the exclusive information and own secret information.

FIG. 10 is a view showing a set-up phase in the exclusive key sharing method according to the fourth embodiment of the present invention. In FIG. 10, terminals 1 to 6 are radio communication terminals. The broadcast communication network 13 is a radio communication network which enables the broadcast communication. Storing portions 7 to 12 are storing portions in the terminals 1 to 6. FIG. 11 is a view showing a preparatory phase in the exclusive key sharing method according to the fourth embodiment of the present invention. In FIG. 11, the terminal 2 is the chairman terminal. The terminal 5 is a particular terminal as the excluded object. FIG. 12 is a view showing a key sharing phase in the exclusive key sharing method according to the fourth embodiment of the present invention.

An operation of the exclusive key sharing method according to the fourth embodiment of the present invention as constructed above will be explained hereunder. At first, the set-up phase will be explained with reference to FIG. 10.

In the communication system which consists of six terminals 1 to 6 mutually via a broadcast communication network 13, the system secret key is S and managed in secret by the system manager. Suppose that a prime number which is larger than S and 6 (terminal number N) or a power number of the prime number is p, and a measure of (p−1) is q. As sizes of p and q, |p|=1024 bit or more and |q|=160 bit or more are preferable from the security aspect respectively. The element of GF(p) is g and opened publicly.

Also, the chairman terminal opens publicly the public key of the system

y=g^(S) modp.

This y is not always opened publicly. The chairman terminal opens publicly

 y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp

as the public information of the terminals.

Meanwhile, the chairman terminal calculates S₁, . . . , S₆ as the secret information of the terminals and distributes them in secret to the respective terminals. The respective terminals hold the secret information S₁, . . . , S₆ in secret in the storing portions 7 to 12. The secret information S₁, . . . , S₆ satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

S _(i) =S+f ₁ ×i modq

λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated)

(where f1 is a non-zero element of GF(q)), and Λ is a set of any two terminals out of six terminals).

Then, the preparatory phase will be explained with reference to FIG. 11. The chairman terminal 2 generates arbitrarily a non-zero element k of GF(q), and then calculates the exclusive information

C 2 ₅ =y ₅ ^(k) modp,

based on the public information y₅ of the particular terminal 5. The chairman terminal 2 calculates a signature

Z=C 2 ₅×(−S ₂)+k modq

by using own secret information S₂, and then broadcasts the signature together with the exclusive information C2 ₅, the particular terminal number 5, and own terminal number 2 to all terminals.

Third, the key sharing phase will be explained with reference to FIG. 12 hereunder. The chairman terminal 2 calculates the common key

K=y ^(k) modp.

If y is not opened publicly, the chairman terminal 2 calculates K in the same manner as other terminals.

The respective terminals 1, 3, 4, 6 calculate

C 1=g ^(z) ×y ₂{circumflex over ( )}(C 2 ₅) modp

by using the public information y₂ of the chairman terminal 2. If a signer is surely the chairman terminal 2 and also the signature Z, the exclusive information C2 ₅, the particular terminal numbers 5, and the terminal number 2 of the chairman terminal are not tampered, C1=g^(k) modp is calculated.

The respective terminals j (j=1, 3, 4, 6) calculate λ(j, Λ) and λ(5, Λ) where Λ={j,5} and also calculate

C 1{circumflex over ( )}(S _(j)×λ(j, Λ) mod q)×C 2 ₅{circumflex over ( )}(λ(5, Λ) modq) modp

by using the preparatory information C1, the exclusive information C2 ₅, and own secret information S_(j) to thus obtain the common key K. However, the terminal 5 cannot calculate the common key K. In this manner, the terminals other than the terminal 5 can share the common key K.

In this case, other processes correspond to those in the first to third embodiments. In addition, the chairman terminal may calculate a hash value

H=hash(C 2 ₅)

which is obtained by compressing the exclusive information C2 ₅ by using the Hash function hash ( ), and may also calculate a signature

Z=H×(−S ₂)+k modq

by using own secret information S₂, and then may broadcast the signature Z together with the exclusive information C2 ₅, the particular terminal number 5, and own terminal number 2 to all terminals. The bit number of the hash value is set equal to the bit number of q, or a residue of q is employed if such bit number is larger than q. Not only the exclusive information C2 ₅ but also the particular terminal number or the chairman terminal number may be calculated as the hash function.

In this case, the respective terminals j (j≠5,2) calculate a hash value H′ which is obtained by compressing the exclusive information C2 ₅ by using the Hash function hash ( ), and also calculate

C 1=g ^(z) ×y ₂ ^(H′) modp

by using public information y₂ of the chairman terminal. If the signer is surely the chairman terminal 2 and also the signature Z, the exclusive information C2 ₅, the particular terminal numbers 5, and the terminal number 2 of the chairman terminal are not tampered, C1=g^(k) modp and H′=H are calculated.

The respective terminals j calculate λ(j, Λ) and λ(5, Λ) where Λ={j,5} and also calculate C1{circumflex over ( )}(S_(j)×λ(j, Λ) modq)×C2 ₅{circumflex over ( )}(λ(5, Λ) modq) modp by using the preparatory information C1, the exclusive information C2 ₅, and own secret information S_(j) to thus obtain the common key K.

As described above, according to the fourth embodiment of the present invention, the exclusive key sharing method is constructed such that, in the communication system consisting of six terminals to allow broadcast communication, the chairman terminal broadcasts a signature together with the exclusive information, the particular terminal number, and own terminal number to all terminals, while respective terminals check that a signer is surely the chairman terminal and also the signature, the exclusive information, the particular terminal numbers, and the chairman terminal number are not tampered and then calculate the common key by using the exclusive information and own secret information. Therefore, while excluding the particular terminals by checking the signature, other terminals can share the key information.

(Fifth Embodiment)

A fifth embodiment of the present invention is an exclusive key sharing method in which, in a communication system which consists of six terminals connected mutually to allow broadcast communication, the chairman terminal calculates the verification information and then broadcasts the verification information together with the exclusive information and the particular terminal numbers to all terminals, while respective terminals calculate the verification equation by using the public key of the system and own secret information, and then suspends the key sharing if the verification information are not satisfied whereas calculate the common key by using the preparatory information, the exclusive information, and own secret information if the verification information are satisfied.

FIG. 13 is a view showing the set-up phase in the exclusive key sharing method according to the fifth embodiment of the present invention. In FIG. 13, the terminal 1 to the terminal 6 are radio communication terminals, the broadcast communication network 13 is a radio communication network to enable the broadcast communication, and storing portions 7 to 12 are storing portions provided in the terminal 1 to the terminal 6. FIG. 14 is a view showing the preparatory phase in the exclusive key sharing method according to the fifth embodiment of the present invention. In FIG. 14, the terminal 2 is the chairman terminal and the terminal 5 is the particular terminal as the excluded object. FIG. 15 is a view showing the key sharing phase in the exclusive key sharing method according to the fifth embodiment of the present invention.

The exclusive key sharing method according to the fifth embodiment of the present invention is constructed based on the Cramer-Shoup cipher. The Cramer-Shoup cipher is the public key cryptosystem which is able to prove the secure against the adaptive chosen ciphertext attack which is the strongest attacking approach to the public key cryptosystem. The outline of such cipher is given in the following, but please refer to the paper “A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack”, LNCS1462, Advances in Cryptology-CRYPTO'98, Springer to know the details.

The Cramer-Shoup cipher will be outlined hereunder. Suppose that the secret keys are x₁, x₂, y₁, y₂, z, the public keys are X(=g₁ ^(x1)g₂ ^(x2)), Y(=g₁ ^(y1)g₂ ^(y2)), Z(=g₁ ^(z)), g₁, g₂, m is a message, r is a random number, and p is a prime number. Suppose that, if not mentioned particularly, all calculations are made to Zp. Then, q is a measure of q |(p−1), h is a Hash function, and g₁, g₂ are elements of GF(p).

In the case of encryption, the ciphertext is assumed as {u₁, u₂, v, w}, where u₁=g₁ ^(r), u₂=g₂ ^(r), v=X^(r)Y^(cr), w=mZ^(r) (c=h(u₁, u₂) modq). The verification is made based on whether or not u1×1+y1×cu2×2+y2×c=u₁ ^(x1)u₂ ^(x2)(u₁ ^(y1)u₂ ^(y2))^(c)=v is satisfied. The decryption is carried out only when the verified result is correct. The decryption is carried out by using m=w/u₁ ^(z).

An operation of the exclusive key sharing method according to the fifth embodiment of the present invention as constructed above will be explained. At first, the set-up phase will be explained with reference to FIG. 13.

In the communication system which consists of six terminals 1 to 6 mutually via the broadcast communication network 13 to allow the broadcast communication, the system secret keys are α1, α2, β1, β2, γ1, γ2 and managed in secret by the system manager. Suppose that a prime number which is larger than α1, α2, β1, β2, γ1, γ2 and 6 (terminal number) or a power number of the prime number is p, and a measure of (p−1) is q. It is preferable from the security aspect that a size of p is set to |p|=1024 bit or more and that a size of q is set to |q|=160 bit or more respectively. The elements of GF(p) are g₁, g₂, and opened publicly as the system public information.

The respective terminals i (1≦i≦6) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i) in secret in respective memory portions 7 to 12 to satisfy

α1=Σλ(i, Λ)×α1 _(i) (sum of iεΛ is calculated)

(where α1 _(i)=α1+f_(1×i) ¹ modq)

α2=Σλ(i, Λ)×α2 _(i) (sum of iεΛ is calculated)

(where α2 _(i)=α2+f₁×i¹ modq)

β1=Σλ(i, Λ)×β1 _(i) (sum of iεΛ is calculated)

(where β1 _(i)=β1+f₁×i¹ modq)

β2=Σλ(i, Λ)×β2 _(i) (sum of iεΛ is calculated)

(where β2 _(i)=β2+f₁×i¹ modq)

γ1=Σλ(i, Λ)×γ1 _(i) (sum of iεΛ is calculated)

(where γ1 _(i)=γ1+f₁×i¹ modq)

 γ2=Σλ(i, Λ)×γ2 _(i) (sum of iεΛ is calculated)

(where γ2 _(i)=γ2+f₁×i¹ modq)

λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated)

(where f₁ is a non-zero element of GF(q), and Λ is a set of any two terminals out of six terminals).

The respective terminals 1 to 6 can use the public keys of the system

A=g ₁α¹ g ₂α² modp, B=g ₁β¹ g ₂β² modp, Γ=g ₁γ¹ g ₂γ² modp,

the public information

A ₁ =g ₁α¹¹ g ₂α²¹ modp, . . . , A ₆ =g ₁α¹⁶ g ₂α²⁶ modp

B ₁ =g ₁β¹¹ g ₂β²¹ modp, . . . , B ₆ =g ₁β¹⁶ g ₂β²⁶ modp

Γ₁ =g ₁γ¹¹ g ₂γ²¹ modp, . . . , Γ ₆ =g ₁γ¹⁶ g ₂γ²⁶ modp

which are calculated by the secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i), and a Hash function hash ( ). The bit number of the hash value is set to the same bit number as q, and a residue of q is calculated if the bit number is larger than q.

Then, the preparatory phase will be explained with reference to FIG. 14 hereunder. The chairman terminal 2 generates arbitrarily a non-zero element k of GF(q), and then calculates the preparatory information

C 1 ₁ =g ₁ ^(k) modp, C 1 ₂ =g ₂ ^(k) modp.

Also, the chairman terminal calculates the exclusive information

C 2 ₅=Γ₅ ^(k) modp

based on the public information Γ₅ of the particular terminal 5.

The chairman terminal 2 calculates the verification information

v=A ^(k) B{circumflex over ( )}{(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq),

v ₅ =A _(i1) ^(k) B ₅{circumflex over ( )}{(c×k) modq} modp

and then broadcasts the verification information together with the exclusive information C2 ₅ and the particular terminal number 5 to all terminals.

Third, the key sharing phase will be explained with reference to FIG. 15 hereunder. The chairman terminal 2 calculates the common key

 K=Γ ^(k) modp.

The respective terminals j (j≠2,5) calculate λ(j, Λ), λ(5, Λ) where Λ={j,5}, and then calculate the verification equation

(C 1 ₁α^(1j) C 1 ₂α^(2j)(C 1 ₁β^(1j) C 1 ₂β^(2j))^(c)){circumflex over ( )}{λ(j, Λ) modq}×v ₅{circumflex over ( )}{λ(5, Λ) modq} modp=v(c=hash (C 1 ₁ , C 1 ₂) modq)

by using the public keys A, B of the system and own secret information α1 _(j, α2) _(j), β1 _(j), β2 _(j), and then suspends the key sharing unless the verification equation is satisfied.

If the verification equation is satisfied, the respective terminals j calculate (C1 ₁γ^(1j)C1 ₂γ^(2j)){circumflex over ( )}{λ(j, Λ) modq}×C2 ₅{circumflex over ( )}(λ(5, Λ) modq) modp by using λ(j, Λ), λ(5, Λ), the preparatory information C1 ₁, C1 ₂, the exdusive information C2 ₅, and the own secret information γ1 _(j), γ2 _(j) to thus obtain the common key K. The terminal 5 cannot calculate the common key K.

As described above, in the fifth embodiment of the present invention, the exclusive key sharing method for the communication system which consists of six terminals connected mutually to allow broadcast communication is constructed such that the chairman terminal calculates the verification information and then broadcasts the verification information together with the exclusive information and the particular terminal numbers to all terminals, while respective terminals calculate the verification equation by using the public key of the system and own secret information, and then suspends the key sharing if the verification information are not satisfied whereas calculate the common key by using the preparatory information, the exclusive information, and own secret information if the verification information are satisfied. Therefore, the respective terminals can calculate the common key after they verify the exclusive information issued by the chairman terminal. Remaining processes are applied correspondingly to the first to third embodiments. In this case, the common key K may be calculated by replacing two secret keys γ1, γ2 with one secret key γ, replacing the secret keys γ1 i, γ2 i with γ_(i), replacing the public key of the system Γ=g1γ1g2 γ2 modp with Γ=g1 γ modp, replacing the public information Γ1=g1 γ11g2 γ21 modp, . . . , ΓN=g1 γ1Ng2 γ2N modp with Γ1=g1 γ1 modp, . . . , ΓN=g1 γN modp, and replacing C11 γ1jC12 γ2j{circumflex over ( )}{λ(j, Λ) modq}×C2 i 1{circumflex over ( )}(λ(i1, Λ) modq)× . . . ×C2 id{circumflex over ( )}{λ(id, Λ) modq} modp with C11{circumflex over ( )}{γj×(λ(j, Λ) modq)}×C2 i 1{circumflex over ( )}(λ(i1, Λ) modq)× . . . ×C2 id{circumflex over ( )}(λ(id, Λ) modq) modp.

(Sixth Embodiment)

A sixth embodiment of the present invention is an exclusive key sharing method in which, in a communication system which consists of the base station and a plurality of terminals to allow broadcast communication, the base station generates arbitrarily a non-zero element k of GF(q) and broadcasts it to all terminals, calculates a new element g′(=g^(1/e modq) modp) and replaces the managed element g with it, while the respective terminals i calculate new secret information S_(i)′(=S_(i)×e modq).

FIG. 16 is a view showing a normal condition of the communication system in the exclusive key sharing method according to a sixth embodiment of the present invention. In FIG. 16, 7 denotes the base station and 1 to 6 denote terminals under the management of the base station. A broadcast communication network 80 is a communication path which can broadcast via a radio, etc. FIG. 17 is a view showing a method of updating the element g in the exclusive key sharing method according to the sixth embodiment of the present invention. FIG. 18 is a view showing a method of updating the secret key in the exclusive key sharing method according to the sixth embodiment of the present invention.

The exclusive key sharing method according to the sixth embodiment of the present invention will be explained with reference to FIG. 16 to FIG. 18 hereunder. As shown in FIG. 16, the base station 7 formulates the secret key S and holds it in secret. The base station formulates a prime number p which is larger than the secret key S and 6 or a power number p of the prime number and holds it, and calculates one measure q of (p−1) and holds it, and calculates a non-zero element f₁ of GF(q).

The base station distributes in secret the secret information Si, which are detected by calculating S_(i)=f(i) by using

f(z)=S+f ₁ ×z modq,

to respective terminals i (1≦i≦6) via the cipher communication means.

Suppose that Λ is a set of any two terminals out of six terminals, the secret information Si can satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated.

Where the set Λ−{i} is a set which is obtained by subtracting a set {i} from a set Λ. For example, if Λ={1,2} is assumed, $\begin{matrix} {{\lambda \left( {1,\Lambda} \right)} = {\Pi \left\{ {L/\left( {L - i} \right)} \right\} \left( {L \in \left\{ 2 \right\}} \right)}} \\ {= {{2/\left( {2 - 1} \right)} = 2}} \\ {{\lambda \left( {2,\Lambda} \right)} = {\Pi \left\{ {L/\left( {L - 2} \right)} \right\} \left( {L \in \left\{ 1 \right\}} \right)}} \\ {= {{1/\left( {1 - 2} \right)} = {- 1}}} \\ {\Sigma \quad {\lambda \left( {i,\Lambda} \right)} \times {S_{i}\left( {i \in \Lambda} \right)}} \\ {= {{{\lambda \left( {1,\Lambda} \right)} \times S_{1}} + {{\lambda \left( {2,\Lambda} \right)} \times S_{2}}}} \\ {= {{2 \times {f(1)}} - {f(2)}}} \\ {= {{2 \cdot \left( {S + {f1}} \right)} - \left( {S + {2 \cdot {f1}}} \right)}} \\ {= S} \end{matrix}$

can be calculated.

The respective terminals 1, . . . , 6 hold the secret information Siin storing portions. The base station 7 holds the modulus p, the element g of GF(p) in a storing portion. The base station 7 calculates the public information y₁(=g^(S1) modp), y₂(=g^(S2) modp), . . . , y₆(=g^(S6) modp), which use the secret information S₁, . . . , S₆ as exponents respectively, p as the modulus, and g as the base, and then holds them in the storing portion. The base station 7 calculates the public keys y(=g^(S) modp) of all terminals, which use the secret key S of all terminals 1, . . . , 6 as the exponent, p as the modulus, and g as the base, and then holds them in the storing portion.

The case where the terminal 5 is excluded will be explained. The base station generates arbitrarily a non-zero element k of GF(q) and calculates the preparatory information C₁(=g^(k) modp) which uses k as the exponent, p as the modulus, and g as the base. The base station calculates the exclusive information C₂(=y₅ ^(k) modp), which uses the integer k as the exponent, p as the modulus, and the public information y₅ of the terminal 5 specified by the base station 7 as the base. The base station 7 calculates the common key K(=y^(k) modp=g{circumflex over ( )}(S×k) modp), which uses the integer k as the exponent, p as the modulus, and the public key y of all terminals 1, . . . , 6 as the base. Then, the base station 7 broadcasts the preparatory information C₁, the exclusive information C₂, and the particular terminal number 5 to all terminals.

The key sharing phase executed in the case where all terminals 1, . . . , 4, 6 except the terminal 5 share the common key will be explained hereunder. The terminal 1 calculates

λ(1, Λ)=5/(5−1)=5/4

λ(5, Λ)=1/(1−5)=−1/4

where Λ={1,5} based on own terminal number 1 and the excluded terminal number 5 which has been received. The terminal 1 calculate a product ${{C_{1}\hat{}\left( {S_{j} \times {\lambda \left( {1,\Lambda} \right)}\quad {mod}\quad q} \right)} \times {C_{2}\hat{}\left( {{\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p} = {{{g\hat{}\left( {k \times S_{1} \times {\lambda \left( {1,\Lambda} \right)}\quad {mod}\quad q} \right)} \times {g\hat{}\left( {k \times S_{5} \times {\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q} \right)}\quad {mod}\quad p} = {{{g\hat{}\left( {k \times \left( {{S_{1} \times {\lambda \left( {1,\Lambda} \right)}} + {S_{5} \times {\lambda \left( {5,\Lambda} \right)}\quad {mod}\quad q}} \right)} \right)}\quad {mod}\quad p} = {{{g\hat{}\left( {k \times S\quad {mod}\quad q} \right)}\quad {mod}\quad p} = K}}}$

of a power residue value

 C ₁{circumflex over ( )}(λ(1, Λ) modq) modp

which uses a product of Si and λ(1, Λ) as an exponent and C₁ as the base and a power residue value

C ₂{circumflex over ( )}(λ(5, Λ) modq) modp

which uses λ(5, Λ) as the exponent and C₂ as the base, by using the preparatory information C₁(=g^(k) modp) and the exclusive information C₂(=y₅ ^(k) modp) to thus obtain the common key K.

The terminals 2 to 4, 6 can perform the above calculations similarly. As a result, the terminals 1 to 4, 6 can share the common key K.

In contrast, the terminal 5 cannot decide that the exclusive information C₂(=₅ ^(k)=g{circumflex over ( )}(k×S₅) modp) which is broadcasted from the base station 7 is equal to the power residue value (=C₁ ^(S5) modp=g{circumflex over ( )}(k×S₅ modp) which can be calculated based on the held information, and also cannot calculate λ(5, Λ) because of A={5}. Therefore, the terminal 5 cannot calculate the common key K in the above key sharing phase.

Since respective terminals cannot calculate the secret key S based on

K=g{circumflex over ( )}(S×k) modp,

C ₁ =g ^(k) modp, and

y=g ^(S) modp,

respective divided secret information S_(i) can be reused. For this reason, the set-up is not needed in the following key sharing and therefore only the preparatory phase and the key sharing phase may be repeated.

A method of updating the element g by the base station 7 will be explained with reference to FIG. 17 hereunder. The base station generates arbitrarily a non-zero element e (random number) of GF(q), and broadcasts the e to all terminals. The base station calculates a new element

g′=g ^(1/e modq) modp

and replaces the managed element g with it.

A method of updating the secret key by the terminal will be explained with reference to FIG. 18 hereunder. The respective terminals i calculate new secret information

S _(i) ′=S _(i) ×e modq

and then hold it. At this time, (g′)^(Si′) modp=(g)^(Si) modp is satisfied.

As described above, in the sixth embodiment of the present invention, the exclusive key sharing method is constructed such that the base station generates arbitrarily the non-zero element e of GF(q) and broadcasts it to all terminals, calculates the new element g^(1/e modq) modp and replaces the managed element g with it, while the respective terminals i calculate new secret information S_(i)×e modq. Therefore, the secret key can be updated in a small communication amount and small computational complexity.

(Seventh Embodiment)

A seventh embodiment of the present invention is an exclusive key sharing method in which, in a communication system which consists of six terminals connected mutually to allow broadcast communication, the system manager generates arbitrarily a non-zero element e of GF(q) and broadcasts it to all terminals, calculates a new element g^(1/e modq) modp and replaces the managed element g with it, while the respective terminals i calculate new secret information S_(i)×e modq.

FIG. 19 is a view showing a normal condition in the exclusive key sharing method according to the seventh embodiment of the present invention. In FIG. 19, the system manager 9 is a trusted party which can access the communication system, and formulates the public book to provide it to the terminals. FIG. 20 is a view showing a method of updating the element g in the exclusive key sharing method according to the seventh embodiment of the present invention. FIG. 21 is a view showing a method of updating the secret key in the exclusive key sharing method according to the seventh embodiment of the present invention.

The exclusive key sharing method according to the seventh embodiment of the present invention will be explained with reference to FIG. 19 to FIG. 21 hereunder. As shown in FIG. 19, in the exclusive key sharing method for the communication system which consists of six terminals connected mutually to allow the broadcast communication, the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, elements of GF(p) are g, and the particular terminal number which can be specified by the chairman terminal (to which any terminal can be appointed) is 1.

The respective terminals i (1≦i≦6) hold the secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

(where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of six terminals). Since the prime number p, the measure q, and the elements g, which are managed by a system manager, and the public key for all terminals

y=g ^(S) modp

which is managed by the system manager and the public information

y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp

which are managed by the system manager are opened publicly by listing them on the public book, the respective terminals can use them.

The chairman terminal generates arbitrarily a non-zero element k of GF(q) and calculates the preparatory information

C ₁ =g ^(k) modp,

calculates the exclusive information

C ₂ =y _(n) ^(k) modp,

based on the public information y_(n) of the particular terminal a, and broadcasts the exclusive information C₂ together with the particular terminal number a and the preparatory information C₁ to all terminals. The chairman terminal calculates the common key

K=y ^(k) modp.

The respective terminals j (j≠a) calculated λ(j, Λ) and λ(a, Λ) where Λ={j, a} and calculate

C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C₂{circumflex over ( )}(λ(a, Λ) modq) modp

by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain the common key K which is shared with the chairman terminal.

A method of updating the element g will be explained with reference to FIG. 20 hereunder. The system manager 9 generates arbitrarily a non-zero element e (random number) of GF(q), and then broadcasts the e to all terminals. The system manager calculates the new element

g′=g^(1/e modq) modp

and replaces the managed element g with it.

A method of updating the secret key will be explained with reference to FIG. 21 hereunder. The respective terminals i calculate the new secret information

S _(i) ′=S _(i) ×e modq

and then hold it. At this time, (g′)^(Si′) modp=(g)^(Si) modp is satisfied.

As described above, in the seventh embodiment of the present invention, the exclusive key sharing method is constructed such that the system manager generates arbitrarily the non-zero element e of GF(q) and broadcasts it to all terminals, calculates the new element g^(1/e modq) modp and replaces the managed element g with it, while the respective terminals i calculate new secret information S_(i)×e modq. Therefore, the secret key can be updated in a small communication amount and small computational complexity.

(Eighth Embodiment)

An eighth embodiment of the present invention is an exclusive key sharing method in which, in a communication system consisting of the base station and 6 terminals connected to the base station to allow broadcast communication, the base station generates arbitrarily a non-zero element e of GF(q), broadcasts the encrypted e which is encrypted by using the common key K to all terminals, calculates the new element g^(1/e modq) modp, and replaces the element g with it, while respective terminals j decrypt the encrypted e by using the common key K and calculate new secret information S_(j)×e modq.

FIG. 22 is a view showing an exclusive key sharing method according to an eighth embodiment of the present invention. FIG. 23 is a view showing a method of distributing a random number in the key sharing method according to the eighth embodiment. FIG. 24 is a view showing a method of excluding continuously the terminal in the key sharing method according to the eighth embodiment.

The exclusive key sharing method according to the eighth embodiment of the present invention will be explained with reference to FIG. 22 to FIG. 24 hereunder. As shown in FIG. 22, in the communication system which consists of the base station 7 and 6 terminals connected to the base station 7 to allow broadcast communication, it is assumed that the secret keys are S, the prime number which is larger than S and 6 or a power number of the prime number is p, the measure of (p−1) is q, and the number of terminals which can be specified by the base station (referred to as the “particular terminal number” hereinafter) is 1.

Respective terminals i (1≦i≦6) hold secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

(where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the six terminals).

The base station holds (S, p, g, S₁, . . . , S₆. If the element of GF(p) is assumed to g and the non-zero element of GF(q) is assumed to k, the base station calculates the preparatory information

C ₁ =g ^(k) modp.

Then, the base station calculates the exclusive information

C ₂ =g{circumflex over ( )}(k×S ₃ modq) modp,

based on the secret information S₃ of the particular terminal 3, and broadcasts the exclusive information together with the particular terminal number 3 and the preparatory information C₁ to all terminals. Then, the base station calculates the common key

K=g{circumflex over ( )}(k×S modq) modp

which is shared with all terminals j (j≠3) except the particular terminal 3.

The respective terminals j (j≠3) calculate a product

C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C₂{circumflex over ( )}(λ(3, Λ) modq) modp

of a power residue value of C₁

C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq) modp

which uses a product of Si and λ(j, Λ) to the modulus q as an exponent and a power residue value of C₂

C ₂{circumflex over ( )}(λ(3, Λ) modq) modp

which uses λ(a, Λ) calculated to the modulus p as the exponent by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain and hold the common key K which is shared with the base station.

A method of distributing the random number e will be explained with reference to FIG. 23 hereunder. The base station 7 generates arbitrarily the non-zero element e (random number) of GF(q), and broadcasts the encrypted e which is encrypted by using the common key K to all terminals. The base station calculates the new element

 g′=g ^(1/e modq) modp

and replaces the element g with it.

A method of continuously excluding the terminal will be explained with reference to FIG. 24 hereunder. The respective terminals j decrypt the encrypted e by using the common key K, and calculate and hold the new secret information S_(j)′=S_(j)×e modq. At this time, (g′)^(Sj′) modp=(g)^(Sj) modp is satisfied.

As described above, in the eighth embodiment of the present invention, the exclusive key sharing method is constructed such that the base station generates arbitrarily the non-zero element e of GF(q), broadcasts the encrypted e which is encrypted by using the common key K to all terminals, calculates the new element g^(1/e modq) modp, and replaces the element g with it, whereas the respective terminals j decrypt the encrypted e by using the common key K and calculate the new secret information S_(j)×e modq. Therefore, the secret key can be updated with a small amount of communication and less computational complexity, and the particular terminal can be excluded successively.

(Ninth Embodiment)

A ninth embodiment of the present invention is an exclusive key sharing method in which, in a communication system consisting of 6 terminals connected mutually to allow broadcast communication, the chairman terminal generates arbitrarily a non-zero element e of GF(q), broadcasts the encrypted e which is encrypted by using the common key K to all terminals, calculates the new element g^(1/e modq) modp, and replaces the element g with it, while respective terminals j decrypt the encrypted e by using the common key K and then calculate new secret information S_(j)×e modq.

FIG. 25 is a view showing an exclusive key sharing method according to a ninth embodiment of the present invention. FIG. 26 is a view showing a method of distributing a random number in the key sharing method according to the ninth embodiment. FIG. 27 is a view showing a method of excluding continuously the terminal in the key sharing method according to the eighth embodiment.

The exclusive key sharing method according to the ninth embodiment of the present invention will be explained with reference to FIG. 25 to FIG. 27 hereunder. As shown in FIG. 25, in the communication system consisting of 6 terminals connected mutually to allow broadcast communication, it is assumed that the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, the elements of GF(p) are g, and the particular terminal number which can be specified by the chairman terminal (to which any terminal can be appointed. Here, the terminal 6 is appointed as the chairman terminal.) is 1.

Respective terminals i (1≦i≦6) hold the secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

(where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of six terminals). Since the public key for all terminals

y=g ^(S) modp,

and the public information

y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y ₆ =g ^(S6) modp

are publicly opened by listing them on the public book, the respective terminals i can use them.

The chairman terminal generates the non-zero element k of GF(q) and calculates the preparatory information

C ₁ =g ^(k) modp.

Then, the chairman terminal calculates exclusive information

C ₂ =y ₃ ^(k) modp

based on the public information y₃ of the particular terminal 3, and then broadcasts the exclusive information together with the particular terminal number 3 and the preparatory information C₁ to all terminals. Then, the chairman terminal calculates the common key

K=y ^(k) modp.

The respective terminals j (j≠3) calculate λ(j, Λ) and λ(3, Λ) where Λ={j,3}, and calculate

C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C ₂{circumflex over ( )}(λ(3, Λ) modq) modp

by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain the common key K which is shared with the chairman terminal.

Then, the method of distributing the random number will be explained with reference to FIG. 26 hereunder. The chairman terminal generates arbitrarily the non-zero element e (random number) of GF(q), and then broadcasts the encrypted e which is encrypted by using the common key K to all terminals. Then, the chairman terminal calculates the new element

g′=g ^(1/e modq) modp

and replaces the element g with it.

Then, the method of excluding continuously the terminal will be explained with reference to FIG. 27 hereunder. The respective terminals j decrypt the encrypted e by using the common key K, and calculate and hold the new secret information

S _(j) ′=S _(j) ×e modq.

At this time, (g′)^(Sj′) modp=(g)^(Sj) modp is satisfied.

As described above, in the ninth embodiment of the present invention, the exclusive key sharing method is constructed such that the chairman terminal generates arbitrarily the non-zero element e of GF(q), broadcasts the encrypted e which is encrypted by using the common key K to all terminals, calculates the new element g^(1/e modq) modp, and replaces the element g with it, whereas respective terminals j decrypt the encrypted e by using the common key K and then calculate the new secret information S_(j)×e modq. Therefore, the secret key can be updated with a small amount of communication and less computational complexity, and the particular terminal can be excluded continuously.

In this case, in order to restore the continuously excluded terminal, a pair of the secret key and the public key must be newly formulated. Although the preceding public key cannot be employed, the continuously excluded terminal can be restored without the formulation of a new pair of the secret key and the public key. For such purpose, the following procedures may be requested.

The base station or the chairman terminal distributes the element e to the particular terminal 3. Then, the particular terminal 3 calculates the new secret information

S ₃ ′=S ₃ ×e modq.

(At this time, (g′){circumflex over ( )}S₃′ modp=(g){circumflex over ( )}S₃ modp is satisfied.) In this manner, the preceding public key can be employed as it is in place of formulating newly a pair of the secret key and the public key. In the event that only several terminals out of a plurality of particular terminals should be restored, the element e may be distributed in secret only to the restored terminals.

(Tenth Embodiment)

A tenth embodiment of the present invention is an exclusive key sharing method in which, in a communication system consisting of 6 terminals connected mutually to allow broadcast communication, the chairman terminal generates arbitrarily a non-zero element k of GF(q), calculates the preparatory information C₁, calculates the exclusive information C₂ based on the public information y_(a) of the particular terminal a, broadcasts it together with the particular terminal number a and the preparatory information C₁ to all terminals to obtain the common key K, while respective terminals j calculate the common key K by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j).

FIG. 28 is a view showing an exclusive key sharing method according to a tenth embodiment of the present invention. The key sharing method according to the tenth embodiment of the present invention will be explained with reference to FIG. 28 hereunder. In a communication system which consists of 6 terminals connected mutually to allow broadcast communication, it is assumed that secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, elements of GF(p) are g, and the particular terminal number which can be specified by a chairman terminal 100 is 1,

Respective terminals i (1≦i≦6) hold the secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

(where S_(i)=S+f₁×i modq (f₁ is a non-zero element of GF(q), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ-−{i} is calculated), and A is a set of any two terminals out of six terminals). Since the chairman terminal 100 publicly opens the public key for all terminals

y=g ^(S) modp,

the public information

y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y ₆ =g ^(S6) modp

by listing them on the public book, respective terminals i can use them.

The chairman terminal 100 generates arbitrarily a non-zero element k of GF(q) and calculates preparatory information

C 1=g ^(k) modp.

The chairman terminal calculates the exclusive information

C ₂ =y _(a) ^(k) modp,

based on the public information y_(a) of the particular terminal a, and then broadcasts the exclusive information together with the particular terminal number a and the preparatory information C₁ to all terminals. The chairman terminal calculates the common key

K=y ^(k) modp.

The respective terminals j (j≠a, b) calculate λ(j, Λ) and λ(a, Λ) where Λ={j,a}, and calculate

C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C ₂{circumflex over ( )}(λ(a, Λ) modq) modp

by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to obtain the common key K.

In this case, if all terminals except the chairman terminal can use the public information

y _(b) =g ^(Sb) modp

of the chairman terminal and the chairman terminal can add a digital signature to the particular terminal number a, the preparatory information C₁, and the exclusive information C₂, which are distributed to all terminals, by using the secret information S_(b) of the chairman terminal, the respective terminals j can verify the signature by using the public information y_(b) of the chairman terminal.

As described above, in the tenth embodiment of the present invention, the exclusive key sharing method is constructed such that the chairman terminal generates arbitrarily a non-zero element k of GF(q), calculates the preparatory information C₁, calculates the exclusive information C₂ based on the public information y_(a) of the particular terminal a, broadcasts it together with the particular terminal number a and the preparatory information C₁ to all terminals to obtain the common key K, while the respective terminals calculate the common key K by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j). Therefore, the particular terminal can be excluded while fixing the chairman terminal.

In this case, if the base station or the chairman terminal distributes the element e to the particular terminal a and the particular terminal a calculates the new secret information

 S _(a) ′=S _(a) ×e modq

(at this time, (g′){circumflex over ( )}S_(a)′ modp=(g){circumflex over ( )}S_(a) modp is satisfied), the excluded terminal can be restored.

In addition, if the multiplication operation can be set to correspond to the addition operation on a curve such as an elliptic curve in any finite field, etc., the operation can be performed at high speed.

(Eleventh Embodiment)

An eleventh embodiment of the present invention is an exclusive key sharing method based on ElGamal cipher in which, since the number of figure of the exponent can be reduced by canceling the denominator of the exponent part in the power calculation and thus the power of the denominator is calculated collectively, the power calculation can be reduced and accelerated.

FIG. 31 is a view showing a set-up phase in the exclusive key sharing method according to the eleventh embodiment of the present invention. In FIG. 31, terminals 1 to 6 are mobile communication terminals and a broadcast network 13 is a radio communication network to enable the broadcast communication. FIG. 32 is a view showing a preparatory phase in the exclusive key sharing method according to the eleventh embodiment of the present invention. FIG. 33 is a view showing a key sharing phase in the exclusive key sharing method according to the eleventh embodiment of the present invention.

In the set-up phase shown in FIG. 31, the system manager generates the secret keys S, the prime number p which is larger than S and the terminal number 6 (or the power number p of the prime number), the measure q of (p−1), and elements g of GF(p), and open publicly p, q, and g. The system manager generates the public key of the system

y=g ^(S) modp

and opens it publicly. The system manager generates elements f₁,f₂ (f₂≠0) of GF(q) and distributes the secret information

 S _(i) =S+f ₁ ×i+f ₂ ×i ² modq (i=1 to 6)

in secret to respective terminals i. The secret information Si satisfies

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

where Λ is a set of any three terminals out of the terminals 1 to 6, and

λ(i, Λ)=Π{(L/L−i)} (product of LεΛ−{i} is calculated).

Although any terminal can be appointed to the chairman terminal, the terminal 2 is appointed to the chairman terminal herein. Suppose that the number of terminals which the chairman terminal 2 can exclude is 2. The case where the terminals 5, 6 are excluded will be explained. Respective terminals 1 to 6 generate the public information

y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp

and open them publicly.

In the preparatory phase shown in FIG. 32, the chairman terminal generates a random number k which is a non-zero element of GF(q), and calculates the preparatory information

C 1=g ^(k) modp.

The chairman terminal 2 calculates exclusive information C2 ₅, C2 ₆ by using the public keys y₅, y₆ of the excluded terminals 5, 6. That is, the chairman terminal 2 calculates the exclusive information

C2 ₅ =y ₅{circumflex over ( )}(k×λ(5,{5,6}) modq) modp

C2 ₆ =y ₆{circumflex over ( )}(k×λ(6,{5,6}) modq) modp

based on λ(5,{5,6}), λ(6,{5,6}) where a set of the particular terminals 5, 6 is α={5,6} and the public keys y₅, y₆, and then broadcasts the exclusive information C2 ₅, C2 ₆ together with the preparatory information C1 and the particular terminal numbers 5, 6 to all terminals.

In the key updating phase shown in FIG. 33, the chairman terminal 2 calculates the common key

 K=y ^(k) modp

which is shared with all terminals 1, 3, 4 except the particular terminals 5, 6. Respective terminals j (1, 3, 4) calculate

λ(j, Λ _(j))=5/(5−j)×6/(6−j)

λ(5, {j, 5,6})=j/(j−5)×6/(6−5)

λ(6, {j, 5,6})=j/(j−6)×5/(5−6)

where Λ_(j)={j,5,6} and

T _(j)={Π(j−L)}/j (product of LεΛ−{i} is calculated)=(j−5)×(j−6)/j,

and then calculate cession keys $\begin{matrix} {K_{j} = {{{C1}\hat{}\left( {S_{j} \times {\lambda \left( {j,\Lambda_{j}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{5}\hat{}\left( {{\lambda \left( {5,\left\{ {j,5,6} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{6}\hat{}\left( {{\lambda \left( {6,\left\{ {j,5,6} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \\ {= {{{C1}\hat{}\left( {S_{j} \times {5/\left( {5 - j} \right)} \times {6/\left( {6 - j} \right)} \times \left( {j - 5} \right) \times {\left( {j - 6} \right)/j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{5}\hat{}\left( {{j/\left( {j - 5} \right)} \times {6/\left( {6 - 5} \right)} \times \left( {j - 5} \right) \times {\left( {j - 6} \right)/j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{6}\hat{}\left( {{j/\left( {j - 6} \right)} \times {5/\left( {5 - 6} \right)} \times \left( {j - 5} \right) \times {\left( {j - 6} \right)/j}\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \\ {= {{{C1}\hat{}\left( {S_{j} \times 5 \times {6/j}\quad {mod}\quad q} \right)} \times {{C2}_{5}\hat{}\left( {6 \times \left( {j - 6} \right)\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{6}\hat{}\left( {{- 5} \times \left( {j - 5} \right)\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \end{matrix}$

by using the preparatory information C1, the exclusive information C2 ₅, C2 ₆, and own secret information S_(j).

Finally, the respective terminals j (1, 3, 4) calculate a power residue value of K_(j)

K _(j){circumflex over ( )}(1/T _(j) modq) modp=K _(j) {circumflex over ( )}[j/{(j−5)(j−6)} modq] modp

which has 1/T_(j) as an exponent and p as a modulus to thus obtain the common key K. However, the terminals 5, 6 cannot calculate the common key K since they have merely S₅, S₆.

In this manner, a total computational complexity can be reduced by simplifying the calculation of the power of the exclusive information C2 ₅, C2 ₆.

If the terminal number of respective terminals is assumed as about D bits, the exponent part of the power residue calculation of the exclusive information, which is performed by respective terminals in the key sharing of the present invention, is D×(h−1) bits. Now, under the conditions that D is 10 bits, h is the number of the excluded terminals, and B_w is the bit number of the exponent part, the power residue calculation between the prior art and the present invention is evaluated by transforming an amount of calculation of the power residue calculation into the number of times of multiplication. In this case, since a numerical value put between parentheses indicates a percentage % of the amount of calculation of the present invention to the prior art, it can be understood that, if such percentage is smaller than 100%, the present invention can achieve the key sharing at higher speed.

h=1: the present invention: B_(—)160×2+B_(—)10 //the number of times of multiplication 495 (increased up to 103%)

the prior art: B_(—)160×2 //the number of times of multiplication 480

h=2: the present invention: B_(—)160×2+B_(—)10×2 //the number of times of multiplication 510 (reduced to 71%)

the prior art: B_(—)160×2+B_(—)160×1 //the number of times of multiplication 720

h=3: the present invention: B_(—)160×2+B_(—)20×3 //the number of times of multiplication 570 (reduced to 60%)

the prior art: B_(—)160×2+B_(—)160×2 //the number of times of multiplication 960

h=4: the present invention: B_(—)160×2+B_(—)30×4 //the number of times of multiplication 660 (reduced to 55%)

the prior art: B_(—)160×2+B_(—)160×3 //the number of times of multiplication 1200

h=5: the present invention: B_(—)160×2+B_(—)40×5 //the number of times of multiplication 780 (reduced to 54%)

the prior art: B_(—)160×2+B_(—)160×4 //the number of times of multiplication 1440

h=6: the present invention: B_(—)160×2+B_(—)50×6 //the number of times of multiplication 930 (reduced to 55%)

the prior art: B_(—)160×2+B_(—)160×5 //the number of times of multiplication 1680

h=7: the present invention: B_(—)160×2+B_(—)60×7 //the number of times of multiplication 1110 (reduced to 58%)

the prior art: B_(—)160×2+B_(—)160×6 //the number of times of multiplication 1920

h=8: the present invention: B_(—)160×2+B_(—)70×8 //the number of times of multiplication 1320 (reduced to 61%)

the prior art: B_(—)160×2+B_(—)160×7 //the number of times of multiplication 2160

h=9: the present invention: B_(—)160×2+B_(—)80×9 //the number of times of multiplication 1560 (reduced to 65%)

the prior art: B_(—)160×2+B_(—)160×8 //the number of times of multiplication 2400

h=10: the present invention: B_(—)160×2+B_(—)90×10 //the number of times of multiplication 1830 (reduced to 69%)

the prior art: B_(—)160×2+B_(—)160×9 //the number of times of multiplication 2640

h=11: the present invention: B_(—)160×2+B_(—)100×11 //the number of times of multiplication 2130 (reduced to 74%)

the prior art: B_(—)160×2+B_(—)160×10 //the number of times of multiplication 2880

h=12: the present invention: B_(—)160×2+B_(—)110×12 //the number of times of multiplication 2220 (reduced to 71%)

the prior art: B_(—)160×2+B_(—)160×11 //the number of times of multiplication 3120

h=13: the present invention: B_(—)160×2+B_(—)120×13 //the number of times of multiplication 2580 (reduced to 77%)

the prior art: B_(—)160×2+B_(—)160×12 //the number of times of multiplication 3360

h=14: the present invention: B_(—)160×2+B_(—)130×14 //the number of times of multiplication 3210 (reduced to 89%)

the prior art: B_(—)160×2+B_(—)160×13 //the number of times of multiplication 3600

h=15: the present invention: B_(—)160×2+B_(—)140×15 //the number of times of multiplication 3630 (reduced to 94%)

the prior art: B_(—)160×2+B_(—)160×14 //the number of times of multiplication 3840

h=16: the present invention: B_(—)160×2+B_(—)150×16 //the number of times of multiplication 4080 (100%, not reduced)

the prior art: B_(—)160×2+B_(—)160×15 //the number of times of multiplication 4080

Accordingly, in the event that the terminal number is 10 bits, i.e., the terminal number is about 1000, the effective range of the excluded terminal number of the present invention becomes 2 to 15. It is of course that, in the system having the smaller terminal number, the effective range of the excluded terminal number can be expanded rather than the above. In this case, the number of times of multiplication per power residue calculation=the bit number of the exponent part in the power residue calculation×1.5 is assumed. This corresponds to the number of times of calculation obtained when the normal binary notation is employed.

In addition, since the table is not needed in the present invention, the present invention is effective for the hardware such as the mobile terminal in which a memory capacity is limited.

(Twelfth Embodiment)

A twelfth embodiment of the present invention is an exclusive key sharing method in which the increase in the calculation amount can be suppressed by calculating inverse elements of the exclusive information when the exponent of the power is minus and also the calculation of the reciprocal number can be reduced by calculating the denominators of the exponents in a lump.

A configuration of the communication system and an operation in the set-up phase in the twelfth embodiment of the present invention are similar to those in the eleventh embodiment. An example in which the chairman terminal excludes the terminals 5, 6 will be explained hereunder.

In the preparatory phase, the chairman terminal 2 generates the random number k which is a non-zero element of GF(q), and calculates the preparatory information

C 1=g ^(k) modp.

The chairman terminal 2 calculates exclusive information

C 2 ₅ =y ₅ ^(k) modp, C 2 ₆ =y ₆ ^(k) modp

by using the public keys y₅, y₆ of the excluded terminals 5, 6, and then broadcasts the exclusive information C2 ₅, C2 ₆ together with the preparatory information C1 and the particular terminal numbers 5, 6 to all terminals.

In the key updating phase, the respective terminals j except the chairman terminal and the excluded terminals calculate inverse elements

F ₅ =C 2 ₅ ⁽⁻¹⁾ modp, F ₆ =C 2 ₆ ⁽⁻¹⁾ modp

of the exclusive information C2 ₅, C2 ₆. The respective terminals j calculate

λ(j, Λ _(j))={5/(5−j)}×{6/(6−j)}

λ(5, Λ_(j))={j/(j−5)}×{6/(6−5)}

λ(6, Λ_(j))={j/(j−6)}×{5/(5−6)}

where Λ_(j)={j, 5, 6} and then calculate cession keys $\begin{matrix} {K_{j} = {{{C1}\hat{}\left( {S_{j} \times {\lambda \left( {j,\Lambda_{j}} \right)} \times t_{j}\quad {mod}\quad q} \right)} \times {{C2}_{5}\hat{}\left( {{\lambda \left( {5,\Lambda_{j}} \right)} \times t_{j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{6}\hat{}\left( {{\lambda \left( {6,\Lambda_{j}} \right)} \times t_{j}\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \\ {= {{{C1}\hat{}\left\{ {S_{j} \times {5/\left( {5 - j} \right)} \times {6/\left( {6 - j} \right)} \times {{5 - j}} \times {{6 - j}}\quad {mod}\quad q} \right\}} \times}} \\ {{{{C2}_{5}\hat{}\left\{ {{j/\left( {j - 5} \right)} \times {6/\left( {6 - 5} \right)} \times {{5 - j}} \times {{6 - j}}\quad {mod}\quad q} \right\}} \times}} \\ {{{{C2}_{6}\hat{}\left\{ {{j/\left( {j - 6} \right)} \times {5/\left( {5 - 6} \right)} \times {{5 - j}} \times {{6 - j}}\quad {mod}\quad q} \right\}}\quad {mod}\quad p}} \\ {= {{{C1}\hat{}\left\{ {S_{j} \times 5 \times 6 \times {sgn}\quad \left( {5 - j} \right) \times {sgn}\quad \left( {6 - j} \right)\quad {mod}\quad q} \right\}} \times}} \\ {{{{C2}_{5}\hat{}\left\{ {j \times {{sgn}\left( {j - 5} \right)} \times 6 \times {{6 - j}}\quad {mod}\quad q} \right\}} \times}} \\ {{{{C2}_{6}\hat{}\left( {{- j} \times {{sgn}\left( {j - 6} \right)} \times 5 \times {{5 - j}}\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \end{matrix}$

by using a positive square root of an absolute value of a product of these denominators $\begin{matrix} {{t_{j} = {{{5 - j}} \times {{6 - j}} \times {{6 - 5}}}}\quad} \\ {{= {{{5 - j}} \times {{6 - j}}}},} \end{matrix}$

the preparatory information C1, the exclusive information C2 ₅, C2 ₆, and own secret information S_(j). Where sgn(x)=x/|x|.

In this case, if λ(5, Λ_(j))<0, i.e., sgn(j−5)=−1, the respective terminals j replace λ(5, Λ_(j)) with |λ(5, Λ_(j))| and replace C2 ₅ with F₅, and then calculate

C 2 ₅ {circumflex over ( )}{j×(−1)×6×|6−j| modq}=F ₅ {circumflex over ( )}{j×6×|6−j| modq}.

If λ(6, Λ_(j))<0, i.e., −sgn(j−6)=−1, the respective terminals j replace λ(6, Λ_(j)) with |λ(6, Λ_(j))| and replace C2 ₆ with F₆, and then calculate

C 2 ₆ {circumflex over ( )}{−j×5×|5−j| modq} modp =F ₆ {circumflex over ( )}{j×5×|5−j| modq} modp.

Finally, the respective terminals j calculate a power residue value of K_(j)

K _(j){circumflex over ( )}(1/t _(j) modq) modp=K _(j){circumflex over ( )}{1/(|5−j|×|6−j|) modq} modp

which has 1/t_(j) as an exponent and p as a modulus to thus obtain the common key K.

In this example, the respective terminals calculate the inverse elements of the exclusive information. But the chairman terminal may calculate the inverse elements of the exclusive information and then broadcast them to all terminals.

In this fashion, since the bit number of the exponent can be reduced by canceling the denominators of the exponents as positive numbers, an amount of calculation of the power can be reduced.

(Thirteenth Embodiment)

A thirteenth embodiment of the present invention is an exclusive key sharing method in which the increase in the calculation amount can be suppressed by calculating inverse elements of the exclusive information when the exponent of the power is minus and also the calculation of the reciprocal number can be reduced by calculating the denominators of the exponents in a lump.

A configuration of the communication system and an operation in the set-up phase and the preparatory phase in the thirteenth embodiment of the present invention are similar to those in the eleventh embodiment. An example in which the chairman terminal 2 excludes the terminals 5, 6 will be explained hereunder.

In the key updating phase, the respective terminals j (j≠2, 5, 6) calculate inverse elements

F ₅ =C 2 ₅ ⁽⁻¹⁾ modp, F ₆ =C 2 ₆ ⁽⁻¹⁾ modp

of the exclusive information C2 ₅, C2 ₆. The respective terminals j calculate

λ(j, Λ _(j))=5/(5−j)×6/(6−j)

λ(5, {j, 5})=j/(j−5)

λ(6, {j, 6})=j/(j−6)

where Λ_(j)={j, 5, 6} and $\begin{matrix} {T_{j} = {{\left\{ {\Pi \left( {j - L} \right)} \right\}/j}\quad \left( {{{product}\quad {of}\quad L} \in {\Lambda - {\left\{ i \right\} \quad {is}\quad {calculated}}}} \right)}} \\ {= {\left( {j - 5} \right) \times {\left( {j - 6} \right)/j}}} \end{matrix}$

and then calculate cession keys $\begin{matrix} {K_{j} = {{{C1}\hat{}\left( {S_{j} \times {\lambda \left( {j,\Lambda_{j}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{5}\hat{}\left( {{\lambda \left( {5,\left\{ {j,5} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{6}\hat{}\left( {{\lambda \left( {6,\left\{ {j,6} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \\ {= {{{C1}\hat{}\left( {S_{j} \times {5/\left( {5 - j} \right)} \times {6/\left( {6 - j} \right)} \times \left( {j - 5} \right) \times {\left( {j - 6} \right)/j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{5}\hat{}\left( {{j/\left( {j - 5} \right)} \times \left( {j - 5} \right) \times {\left( {j - 6} \right)/j}\quad {mod}\quad q} \right\}} \times}} \\ {{{{C2}_{6}\hat{}\left( {{j/\left( {j - 6} \right)} \times \left( {j - 5} \right) \times \left( {j - 6} \right)\quad {mod}\quad q} \right\}}\quad {mod}\quad p}} \\ {= {{{C1}\hat{}\left( {S_{j} \times 5 \times 6 \times {/j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{5}\hat{}\left( {\left( {j - 6} \right)\quad {mod}\quad q} \right)} \times {{C2}_{6}\hat{}\left( {\left( {j - 5} \right)\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \end{matrix}$

by using the preparatory information C1, the exclusive information C2 ₅, C2 ₆, and own secret information S_(j).

In this case, if λ(5, {j, 5})×T_(j)<0, i.e., (j−6)<0, the respective terminals j replace λ(5, {j, 5})×T_(j) with |λ(5, {j, 5})×T_(j)| and replace C2 ₅ with F₅, and then calculate

C 2 ₅{circumflex over ( )}((j−6) modq)=F ₅{circumflex over ( )}((6−j) modq).

If λ(6, {j, 6})×T_(j)<0, i.e., (j−5)<0, the respective terminals j replace λ(6, {j, 6})×T_(j) with |λ(6, {j, 6})×T_(j)| and replace C2 ₆ with F₆, and then calculate

C 2 ₆{circumflex over ( )}((j−5) modq)=F ₆{circumflex over ( )}((5−j) modq).

Finally, the respective terminals j calculate a power residue value of K_(j)

K _(j){circumflex over ( )}(1/T _(j) modq) modp=K _(j){circumflex over ( )}(j/{(j−5)×(j−6)} modq) modp

which has 1/T_(j) as an exponent and p as a modulus to thus obtain the common key K.

In this example, the respective terminals calculate the inverse elements of the exclusive information. However, the chairman terminal may calculate the inverse elements of the exclusive information and then broadcast them to all terminals.

In this way, since the bit number of the exponent can be reduced by canceling the denominators of the exponents as positive numbers, an amount of calculation of the power can be reduced.

(Fourteenth Embodiment)

A fourteenth embodiment of the present invention is an exclusive key sharing method based on the recovery type signature, in which authentication of the chairman terminal can be performed and the calculation of power can be reduced by reducing the number of figure of the exponent part.

A configuration of the communication system in the fourteenth embodiment of the present invention is similar to that in the eleventh embodiment. An example in which the chairman terminal excludes the terminals 5, 6 will be explained hereunder.

In the set-up phase, the Hash function hash ( ) is publicly opened. Other processes are similar to those in the eleventh embodiment.

In the preparatory phase, the chairman terminal calculates a hash value

H=hash(C 2 ₅ , C 2 ₆)

which is obtained by compressing the exclusive information C2 ₅, C2 ₆ by using the Hash function hash ( ).

The chairman terminal calculates a signature

Z=H×(−S ₂)+k modq

by using own secret information S₂, and then broadcasts the signature Z together with the exclusive information C2 ₅, C2 ₆, the particular terminal number 5, 6, and own terminal number 2 to all terminals.

In the key updating phase, the respective terminals j (j≠2, 5, 6) calculate a hash value H′ which is obtained by compressing the exclusive information C2 ₅, C2 ₆ by using the Hash function hash ( ). The respective terminals j calculate

C 1=g ^(z) ×y ₂ ^(H′) modp

(if a signer is surely the chairman terminal 2 and also the signature Z, the exclusive information C2 ₅, C2 ₆, the particular terminal numbers 5, 6, and the terminal number 2 of the chairman terminal are not tampered, C1=g^(k) modp and H′=H are calculated) by using public information y₂ of the chairman terminal. Other calculations are identical to the eleventh embodiment. In this case, the same advantages can be achieved if other processes are performed in the same way as the second and thirteenth embodiments.

In this manner, respective terminals can authenticate the chairman terminal.

(Fifteenth Embodiment)

A fifteenth embodiment of the present invention is an exclusive key sharing method based on Cramaer-Shoup cipher in which, since the number of figure of the exponent can be reduced by canceling the denominator of the exponent part in the power calculation and thus the power of the denominator is calculated collectively, the power calculation can be reduced and accelerated.

A configuration of the communication system in the fifteenth embodiment of the present invention is similar to that in the eleventh embodiment. An example in which the chairman terminal excludes the terminals 5, 6 will be explained hereunder.

In the set-up phase, the chairman terminal distributes the secret keys are α1, α2, β1, β2, γ1, γ2 to respective terminals. The respective terminals i (1≦i≦6) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i) in secret to satisfy

α1=Σλ(i, Λ)×α1 _(i) (sum of iεΛ is calculated)

(where α1 _(i)=α1+f₁×i¹+f₂×i² modq)

α2=Σλ(i, Λ)×α2 _(i) (sum of iεΛ is calculated)

(where α2 _(i)=α2+f₁×i¹+f₂×i² modq)

 β1=Σλ(i, Λ)×β1 _(i) (sum of iεΛ is calculated)

(where β1 _(i)=β1+f₁×i¹+ . . . +f₂×i² modq)

β2=Σλ(i, Λ)×β2 _(i) (sum of iεΛ is calculated)

(where β2 _(i)=β2+f₁×i¹+f₂×i² modq)

γ1=Σλ(i, Λ)×γ1 _(i) (sum of iεΛ is calculated)

(where γ1 _(i)=γ1+f₁×i¹+f₂×i² modq)

γ2=Σλ(i, Λ)×γ2 _(i) (sum of iεΛ is calculated)

(where γ2 _(i)=γ2+f₁×i¹+f₂×i² modq)

λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated)

(where f₁, f₂ are elements of GF(q), f₂≠0, and Λ is a set of any three terminals out of six terminals). The respective terminals i open publicly public keys of the system

A=g ₁ ^(α1) g ₂ ^(α2) modp, B=g ₁ ^(β1) g ₂ ^(β2) modp, Γ=g ₁ ^(γ1) g ₂ ^(γ2) modp,

the public information

A ₁ =g ₁ ^(α11) g ₂ ^(α21) modp, . . . , A ₆ =g ₁ ^(α16) g ₂ ^(α26) modp

B ₁ =g ₁ ^(β11) g ₂ ^(β21) modp, . . . , B ₆ =g ₁ ^(β16) g ₂ ^(β26) modp

Γ₁ =g ₁ ^(γ11) g ₂ ^(γ21) modp, . . . , Γ ₆ =g ₁ ^(γ16) g ₂ ^(γ26) modp

which are calculated by the secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i) the prime number p, the measure q, the elements g1, g2, and the Hash function hash ( ).

In the preparatory phase, the chairman terminal generates arbitrarily the non-zero element k of GF(q), and then calculates the preparatory information

C 1 ₁ =g ₁ ^(k) modp, C 1 ₂ =g ₂ ^(k) modp,

The chairman terminal calculates the exclusive information

C 2 ₅=Γ₅{circumflex over ( )}(k×λ(5, α) modq) modp=Γ ₅{circumflex over ( )}(k×6) modq) modp

C 2 ₆=Γ₆{circumflex over ( )}(k×λ(6, α) modq) modp=Γ ₆{circumflex over ( )}(−k×5) modq) modp

based on a set α={5, 6} of two particular terminals 5, 6,

λ(5, α)=6/(6−5)=6,

 λ(6, α)=5/(5−6)=5,

and the public information Γ₅, Γ₆,

The chairman terminal calculates the verification information

v=A ^(k) B{circumflex over ( )}{(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq),

v ₅ =[A ₅ ^(k) B ₅{circumflex over ( )}{(c×k) modq}]{circumflex over ( )}{λ(5, α) modq} modp,

v ₆ =[A ₆ ^(k) B ₆{circumflex over ( )}{(c×k) modq}]{circumflex over ( )}{λ(6, α) modq} modp,

and then broadcasts the verification information together with the exclusive information C2 ₅, C2 ₆, and the particular terminal numbers 5, 6 to all terminals,

The chairman terminal calculates the common key

K=Γ ^(k) modp.

In the key updating phase, the respective terminals j (≠2, 5, 6) calculate

λ(j, Λ _(j))=5/(5−j)×6/(6−j)

λ(5, {j, 5})=j/(j−5)

λ(6, {j, 6})=j/(j−6)

where Λ={j, 5, 6} and $\begin{matrix} {T_{j} = {{\left\{ {\Pi \left( {j - L} \right)} \right\}/j}\quad \left( {{{product}\quad {of}\quad L} \in {\Lambda_{j} - {\left\{ j \right\} \quad {is}\quad {calculated}}}} \right)}} \\ {= {\left( {j - 5} \right) \times {\left( {j - 6} \right)/{j.}}}} \end{matrix}$

Then, the respective terminals j calculate a verification equation ${\left. {{\left. {\left( {{C1}_{1}{\alpha \quad}^{1j}{C1}_{2}{\alpha^{2j}\left( {{C1}_{1}\beta^{1j}{C1}_{2}\beta^{2j}} \right)}^{c}} \right)\hat{}\left\{ {{\lambda \left( {j,\Lambda_{j}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \right\} \times {v_{5}\hat{}\left\{ {{\lambda \left( {5,\left\{ {j,5} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right\}} \times {v_{6}\hat{}\left\{ {{\lambda \left( {6,\left\{ {j,6} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right\}}\quad {mod}\quad p} = {\left( {{C1}_{1}\alpha^{1j}{C1}_{2}{\alpha^{2j}\left( {{C1}_{1}\beta^{1j}{C1}_{2}\beta^{2j}} \right)}^{c}} \right)\hat{}\left\{ {{5/\left( {5 - j} \right)} \times {6/\left( {6 - j} \right)} \times \left( {j - 5} \right) \times {\left( {j - 6} \right)/j}\quad {mod}\quad q} \right)}} \right\} \times {v_{5}\hat{}\left\{ {{j/\left( {j - 5} \right)} \times \left( {j - 5} \right) \times {\left( {j - 6} \right)/j}\quad {mod}\quad q} \right\}} \times {v_{6}\hat{}\left\{ {{j/\left( {j - 6} \right)} \times \left( {j - 5} \right) \times {\left( {j - 6} \right)/j}\quad {mod}\quad q} \right\}}\quad {mod}\quad p} = {{\left( {{C1}_{1}\alpha^{1j}{C1}_{2}{\alpha^{2j}\left( {{C1}_{1}\beta^{1j}{C1}_{2}\beta^{2j}} \right)}^{c}} \right)\hat{}\left\{ {5 \times {6/j}\quad {mod}\quad q} \right\}} \times {v_{5}\hat{}\left\{ {\left( {J - 6} \right)\quad {mod}\quad q} \right\}} \times {v_{6}\hat{}\left\{ {\left( {j - 5} \right)\quad {mod}\quad q} \right\}}\quad {mod}\quad {p\left( {c = {{hash}\quad \left( {{C1},\quad {C1}_{2}} \right)\quad {mod}\quad q}} \right)}}$

by using the public keys A, B of the system and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), and then stop key sharing if coincidence between the verification equation and v{circumflex over ( )}{(j−5)×(j−6)/j modq} modp is not satisfied.

If the verification equation is satisfied, the respective terminals j calculate the cession keys $\begin{matrix} {K_{j} = {{\left( {{C1}_{1}\gamma^{1j}{C1}_{2}\gamma^{2j}} \right)\hat{}\left\{ {{\lambda \left( {j,\Lambda_{j}} \right)} \times T_{j}\quad {mod}\quad q} \right\}} \times}} \\ {{{C2}_{5}\hat{}\left\{ {{\lambda\left( {5,{\left\{ {j,5} \right\} \times T_{j}\quad {mod}\quad q}} \right\}} \times {{C2}_{6}\hat{}\left\{ {{\lambda \left( {6,\left\{ {j,6} \right\}} \right)} \times} \right.}} \right.}} \\ {\left. {T_{j}\quad {mod}\quad q} \right\} \quad {mod}\quad p} \\ {= {\left( {{C1}_{1}\gamma^{1j}{C1}_{2}\gamma^{2j}} \right)\hat{}\left\{ {{5/\left( {5 - j} \right)} \times {6/\left( {6 - j} \right)} \times \left( {j - 5} \right) \times} \right.}} \\ {\left. {{\left( {j - 6} \right)/j}\quad {mod}\quad q} \right\} \times {{C2}_{5}\hat{}\left\{ {{j/\left( {j - 5} \right)} \times \left( {j - 5} \right) \times} \right.}} \\ {\left. {{\left( {j - 6} \right)/j}\quad {mod}\quad q} \right\} \times {{C2}_{6}\hat{}\left\{ {{j/\left( {j - 6} \right)} \times \left( {j - 5} \right) \times} \right.}} \\ {\left. {{\left( {j - 6} \right)/j}\quad {mod}\quad q} \right\} \quad {mod}\quad p} \\ {= {{\left( {{C1}_{1}\gamma^{1j}{C1}_{2}\gamma^{2j}} \right)\hat{}\left\{ {5 \times {6/j}\quad {mod}\quad q} \right\}} \times}} \\ {{{{C2}_{5}\hat{}\left\{ {\left( {j - 6} \right)\quad {mod}\quad q} \right\}} \times {{C2}_{6}\hat{}\left\{ {\left( {j - 5} \right)\quad {mod}\quad q} \right\}}\quad {mod}\quad p}} \end{matrix}$

by using the T_(j), λ(j, Λ_(j)), λ(5, {j, 5}), λ(6, {j, 6}), the preparatory information C1 ₁, C1 ₂, the exclusive information C2 ₅, C2 ₆, and own secret information γ1 _(j), γ2 _(j).

Finally, the respective terminals j calculate a power residue value of K_(j)

K _(j){circumflex over ( )}(1/T _(j) modq) modp=K _(j){circumflex over ( )}(j/{(j−5)×(j−6)} modq) modp

which has 1/T_(j) as an exponent and p as a modulus to thus obtain the common key K.

In the exclusive key sharing method based on Cramaer-Shoup cipher, since the number of figure of the exponent can be reduced by canceling the denominator of the exponent part in the power calculation of the verification information and exclusive information and thus the power of the denominator is calculated collectively, the power calculation can be reduced and accelerated.

(Sixteenth Embodiment)

A sixteenth embodiment of the present invention is an exclusive key sharing method based on the Cramaer-Shoup cipher in which, since the number of figure of the exponent can be reduced by canceling the denominator of the exponent part in the power calculation, the power of the denominator is calculated collectively, and the calculation is carried out by using the inverse elements if the exponent becomes minus, the power calculation can be reduced and accelerated.

A configuration of the communication system in the sixteenth embodiment of the present invention is similar to that in the eleventh embodiment. An operation in the set-up phase is identical to that in the fifteenth embodiment. An example in which the chairman terminal excludes the terminals 5, 6 will be explained hereunder.

In the preparatory phase, the chairman terminal calculates the exclusive information

C 2 ₅=Γ₅ ^(k) modp, C 2 ₆=Γ₆ ^(k) modp

based on the public information Γ₅, Γ₆ of two particular terminals 5, 6. Then, the chairman terminal calculates the verification information

v=A ^(k) B{circumflex over ( )}{(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq),

v ₅ =A ₅ ^(k) B ₅{circumflex over ( )}{(c×k) modq} modp

v ₆ =A ₆ ^(k) B ₆{circumflex over ( )}{(c×k) modq} modp

and then broadcasts the verification information together with the exclusive information C2 ₅, C2 ₆, and the particular terminal numbers 5, 6 to all terminals.

In the key updating phase, the respective terminals j (j≠2, 5, 6) calculate inverse elements

E ₅ =v ₅ ⁽⁻¹⁾ modp, E ₆ =v ₆ ⁽⁻¹⁾ modp

of the verification information v₅, v₆, and calculate

λ(j, Λ _(j)), λ(5, Λ_(j)), λ(6, Λ_(j))

where Λ_(j)={j, 5, 6}. Then, the respective terminals j calculate a verification equation

(C 1 ₁α^(1j) C 1 ₂α^(2j)(C 1 ₁β^(1j) C 1 ₂β^(2j))^(c)){circumflex over ( )}{λ(j, Λ _(j))×t _(j) modq)}

×v ₅{circumflex over ( )}{λ(5, Λ_(j))×t _(j) modq}×v ₆{circumflex over ( )}{λ(6, Λ_(j))×t _(j) modq} modp=v{circumflex over ( )}{t _(j) modq} modp

by using the positive square root t_(j) of the absolute value of the product of these denominators, the public keys A, B of the system and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), where c=hash (C1 ₁, C1 ₂) modq. Then, the respective terminals j calculate the verification equation by replacing λ(5, Λ_(j)) with |λ(5, Λ_(j))| and replacing v₅ with E₅ if λ(5, Λ_(j))<0 and replacing λ(6, Λ_(j)) with |λ(6, Λ_(j))| and replacing v₆ with E₆ if λ(6, Λ_(j))<0, and then stop the key sharing if the verification equation is not satisfied.

If the verification equation is satisfied, the respective terminals j calculate inverse elements

F ₅ =C 2 ₅ ⁽⁻¹⁾ modp, F ₆ =C 2 ₆ ⁽⁻¹⁾ modp

of the exclusive information C2 ₅, C2 ₆, and then calculate the cession keys $K_{j} = {{\left( {{C1}_{1}\gamma^{1j}{C1}_{2}\gamma^{2j}} \right)\hat{}\left\{ {{\lambda \left( {j,\Lambda_{j}} \right)} \times t_{j}\quad {mod}\quad q} \right\}} \times {{C2}_{5}\hat{}\left\{ {{\lambda \left( {5,\Lambda_{j}} \right)} \times t_{j}\quad {mod}\quad q} \right\}} \times {{C2}_{6}\hat{}\left\{ {{\lambda \left( {6,\Lambda_{j}} \right)} \times t_{j}\quad {mod}\quad q} \right\}}\quad {mod}\quad p}$

by using the t_(j), λ(j, Λ_(j)), λ(5, Λ_(j)), λ(6, Λ_(j)), the preparatory information C1 ₁, C1 ₂, the exclusive information C2 ₅, C2 ₅, and own secret information γ1 _(j), γ2 _(j). In this case, the respective terminals j calculate

C 2 ₅{circumflex over ( )}(−6×j×|6−j| modq)=F ₅{circumflex over ( )}(6×j×|6−j| modq)

by replacing λ(5, Λ_(j)) with |λ(5, Λ_(j)) and replacing C2 ₅ with F₅ if λ(5, Λ_(j))<0 and calculate

C 2 ₆{circumflex over ( )}(−5×j×|5−j| modq) modp=F ₆{circumflex over ( )}(5×j×|5−j| modq) modp

by replacing λ(6, Λ_(j)) with |λ(6, Λ_(j))| and replacing C2 ₆ with F₆ if λ(6, Λ_(j))<0.

Finally, the respective terminals j calculate a power residue value of K_(j)

K _(j){circumflex over ( )}(1/t modq) modp

which has 1/t_(j) as an exponent and p as a modulus to thus obtain the common key K.

In this example, the respective terminals calculate the inverse elements of the exclusive information. But the chairman terminal may calculate the inverse elements of the exclusive information and then broadcast them to all terminals.

In this manner, even if the exponent part of the power calculation of the verification information is negative, the power calculation can be reduced and accelerated by utilizing the inverse element.

(Seventeenth Embodiment)

A sixteenth embodiment of the present invention is an exclusive key sharing method based on the Cramaer-Shoup cipher in which, since the number of figure of the exponent can be reduced by canceling the denominator of the exponent part in the power calculation of the verification information and the exclusive information, the power of the denominator is calculated collectively, and the calculation is carried out by using the inverse elements if the exponent becomes minus, the power calculation can be reduced and accelerated.

A configuration of the communication system in the seventeenth embodiment of the present invention is similar to that in the eleventh embodiment. Operations in the set-up phase and the preparatory phase are identical to that in the fifteenth embodiment. An example in which the chairman terminal 2 excludes the terminals 5, 6 will be explained hereunder.

In the key updating phase, the respective terminals j (j≠2, 5, 6) calculate the inverse elements

E ₅ =v ₅ ⁽⁻¹⁾ modp, E ₆ =v ₆ ⁽⁻¹⁾ modp

of the verification information v₅, v₆, and calculate

λ(j, Λ _(j)), λ(5, {j, 5}), λ(6, {j, 6})

where Λ_(j)={j, 5, 6} and

T _(j)={Π(j−L)}/j (product of LεΛ _(j) −{i} is calculated).

Then, the respective terminals j calculate the verification equation

(C 1 ₁α^(1j) C 1 ₂α^(2j)(C 1 ₁β^(1j) C 1 ₂β^(2j))^(c)){circumflex over ( )}{λ(j, Λ _(j))×T _(j) modq)}

×v ₅{λ(5, {j, 5})×T _(j) modq}×v ₆{circumflex over ( )}{λ(6, {j, 6})×T _(j) modq} modp=

v{circumflex over ( )}{T _(j) modq} modp

by using the public keys A, B of the system and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), where c=hash (C1 ₁, C1 ₂) modq. Then, the respective terminals j calculate the verification equation by replacing λ(5, {j, 5})×T_(j) with |λ(5, {j, 5})×T_(j)| and replacing v₅ with E₅ if λ(5, {j, 5})×T_(j)<0 and replacing λ(6, {j, 6})×T_(j) with |λ(6, {j, 6})×T_(j)| and replacing v₆ with E₆ if λ(6, {j, 6})×T_(j))<0, and then stop the key sharing if the verification equation is not satisfied.

If the verification equation is satisfied, the respective terminals j calculate the inverse elements

F ₅ =C 2 ₅ ⁽⁻¹⁾ modp, F ₆ =C 2 ₆ ⁽⁻¹⁾ modp

of the exclusive information C2 ₅, C2 ₆, and then calculate the cession keys

K _(j)=(C 1 ₁γ^(1j) C 1 ₂γ^(2j)){circumflex over ( )}{λ(j, Λ _(j))×T _(j) modq}×C 2 ₅{circumflex over ( )}{λ(5, {j, 5})×T _(j) modq}×C 2 ₆{circumflex over ( )}{λ(6, {j, 6})×T _(j) modq} modp

by using the T_(j), λ(j, Λ_(j)), λ(5, {j, 5}), λ(6, {j, 6}), the preparatory information C1 ₁, C1 ₂, the exclusive information C2 ₅, C2 ₆, and own secret information γ1 _(j), γ2 _(j). In this case, the respective terminals j calculate the cession keys by replacing λ(5, {j, 5})×T_(j)) with |λ(5, {j, 5})×T_(j)| and replacing C2 ₅ with F₅ if λ(5, {j, 5})×T_(j)<0 and replacing λ(6, {j, 6})×T_(j)) with |λ(6, {j, 6})×T_(j))| and replacing C2 ₆ with F₆ if λ(6, {j, 6})×T_(j))<0.

Finally, the respective terminals j calculate a power residue value of K_(j)

K _(j){circumflex over ( )}(1/T) modq) modp

which has 1/T_(j) as an exponent and p as a modulus to thus obtain the common key K.

In this example, the respective terminals calculate the inverse elements of the verification information and the exclusive information. But the system may be constructed such that the chairman terminal may calculate the inverse elements of the verification information and the exclusive information and then broadcast them to all terminals.

In this manner, even if the exponent part of the power calculation of the verification information and the exclusive information becomes minus, the power calculation can be reduced and accelerated by utilizing the inverse element.

Industrial Applicability

As described above, according to the present invention, the exclusive key sharing method for the communication system which consists of the base station and N terminals connected to the base station to allow broadcast communication is constructed such that the secret keys are S, respective terminals i hold secret information Si in secret to satisfy S=Σλ(i, Λ)×Si, the base station broadcasts preparatory information C1 (g^(k) modp) and exclusive information C2 (g{circumflex over ( )}(k×Sa modq) modp) together with the particular terminal number a to all terminals, and respective terminals j (j≠a) calculate C1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C2{circumflex over ( )}(λ(a, Λ) modq) modp to thus obtain the common key K which is common to the base station. Therefore, simplification of the process and improvement in the security can be implemented.

Also, the exclusive key sharing method is constructed such that the secret keys are S, the particular terminal number is d, respective terminals i hold secret information Si in secret to satisfy S=Σλ(i, Λ)×Si, the base station broadcasts the preparatory information C1=g^(k) modp and the together with the preparatory information C1 and exclusive information C21(g{circumflex over ( )}(k×Si1 modq) modp), . . . , C2 d(g{circumflex over ( )}(k×Sid modq) modp) together with the particular terminal numbers i1, . . . , id to all terminals, and respective terminals j calculate C1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C21{circumflex over ( )}(λ(i1, Λ) modq)× . . . ×C2 d{circumflex over ( )}(λ(id, Λ) modq) modp to thus obtain the common key K which is common to the base station. Therefore, two terminals can be excluded simultaneously by only broadcasting C1, C2 a, C2 b and the particular terminal numbers (a, b) from the base station to all terminals.

Also, the exclusive key sharing method for the communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, and the particular terminal number which can be specified by the chairman terminal φ (to which any terminal can be appointed) d (1≦d<N−1),

respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

λ(i, Λ)=Γ{L/(L−i)} (product of LεΛ−{i} is calculated)

S _(i) =S+f ₁ ×i ¹ + . . . +f _(d) ×i ^(d) modq

(where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any two terminals out of the N terminals), and can use the public key of the system

y=g ^(s) modp,

public information

y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp,

the prime number p, the measure q, and the element g, and

(1) the chairman terminal generates arbitrarily the non-zero element k of GF(q) and then calculates exclusive information

C 2 _(i1) =y _(i1) ^(k) modp, . . . , C 2 _(id) =y _(id) ^(k) modp

based on the public information y_(i1), . . . , y_(id) of the d terminals i₁, . . . , i_(d),

(2) the chairman terminal calculates a signature

Z=C 2 _(i1) × . . . ×C 2 _(id)×(−S _(φ))+k modq

by using own secret information S_(φ), and broadcasts the signature Z together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d) and own terminal number φ to all terminals,

(3) the chairman terminal calculates a common key

K=y ^(k) modp,

(4) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate

C 1=g ^(z) ×y _(φ){circumflex over ( )}(C 2 _(i1) × . . . ×C 2 _(id) modq) modp

(if a signer is surely the chairman terminal φ and also the signature Z, the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d) and the terminal number φ of the chairman terminal are not tampered, C1=g^(k) modp is calculated) by using the public information y_(φ) of the chairman terminal,

(5) the respective terminals j calculate λ(j, Λ) and λ(i₁, Λ), . . . , λ(i_(d), Λ) where Λ={j, i₁, . . . , i_(d)}, and calculate C1{circumflex over ( )}(S_(j)×λ(j, Λ) modq)×C2 _(i1){circumflex over ( )}(λ(i₁, Λ) modq)× . . . ×C2 _(id){circumflex over ( )}(λ(i_(d), Λ) modq) modp by using the C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j) to thus obtain the common key K. Therefore, only the particular terminal can be excluded by a small amount of communication and a short service suspending term and remaining terminals can be shared with the distributed key information.

Also, the exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that the secret keys are α1, α2, β1, β2, γ, the prime number which is larger than α1, α2, β1, β2, γ and N or the power number of the prime number is p, the measure of (p−1) is q, elements of GF(p) are g1, g2, and the particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1),

respective terminals i (1≦i ≦N) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i) in secret to satisfy

α1=Σλ(i, Λ)×α1 _(i) (sum of iεΛ is calculated)

(where α1 _(i)=α1+f₁×i¹+ . . . +f_(d)×i^(d) modq)

α2=Σλ(i, Λ)×α2 _(i) (sum of iεΛ is calculated)

(where α2 _(i)=α2+f₁×i¹+ . . . +f_(d)×i^(d) modq)

 β1=Σλ(i, Λ)×β1 _(i) (sum of iεΛ is calculated)

(where β1 _(i)=β1+f₁×i¹+ . . . +f_(d)×i^(d) modq)

β2=Σλ(i, Λ)×β2 _(i) (sum of iεΛ is calculated)

(where β2 _(i)=β2+f₁×i¹+ . . . +f_(d)×i^(d) modq)

γ1=Σλ(i, Λ)×γ1 _(i) (sum of iεΛ is calculated)

(where γ1 _(i)=γ1+f₁×i¹+ . . . +f_(d)×i^(d) modq)

γ2=Σλ(i, Λ)×γ2 _(i) (sum of iεΛ is calculated)

(where γ2 _(i)=γ2+f₁×i¹+ . . . +f_(d)×i^(d) modq)

λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated)

(where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use public keys of the system

A=g ₁ ^(α1) g ₂ ^(α2) modp, B=g ₁ ^(β1) g ₂ ^(β2) modp, Γ=g ₁ ^(γ1) g ₂ ^(γ2) modp,

public information

A ₁ =g ₁ ^(α11) g ₂ ^(α21) modp, . . . , A _(N) =g ₁ ^(α1N) g ₂ ^(α2N) modp

B ₁ =g ₁ ^(β11) g ₂ ^(β21) modp, . . . , B _(N) =g ₁ ^(β1N) g ₂ ^(β2N) modp

Γ₁ =g ₁ ^(γ11) g ₂ ^(γ21) modp, . . . , Γ _(N) =g ₁ ^(γ1N) g ₂ ^(γ2N) modp

which are calculated by the secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i), the prime number p, the measure q, the elements g₁, g₂, and a Hash function hash ( ), and

(1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates preparatory information

C 1 ₁ =g ₁ ^(k) modp, C 1 ₂ =g ₂ ^(k) modp,

(2) the chairman terminal calculates exclusive information

C 2 _(i1)=Γ_(i1) ^(k) modp, . . . , C 2 _(id)=Γ_(id) ^(k) modp

based on the public information Γ_(i1), . . . , Γ_(id) of the d particular terminals i₁, . . . , i_(d),

(3) the chairman terminal calculates verification information

v=A ^(k) B{circumflex over ( )}{(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq),

v _(i1) =A _(i1) ^(k) B _(i1){circumflex over ( )}{(c×k) modq} modp, . . . ,

v _(id) =A _(i1) ^(k) B _(id){circumflex over ( )}{(c×k) modq} modp

and then broadcasts them together with the exclusive information C2 _(i1), . . . , C2 _(id), and the particular terminal numbers i₁, . . . , i_(d) to all terminals,

(4) the chairman terminal calculates a common key

K=Γ ^(k) modp,

(5) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate λ(j, Λ), λ(i₁, Λ), . . . , λ(i_(d), Λ) where Λ={j, i₁, . . . , i_(d)}, and then calculate a verification equation

(C 1 ₁α^(1j) C 1 ₂α^(2j)(C 1 ₁β^(1j) C 1 ₂β^(2j))^(c)){circumflex over ( )}λ(j, Λ) modq}

×v _(i1){circumflex over ( )}{λ(i ₁, Λ) modq}× . . . ×v _(id){circumflex over ( )}{λ(i _(d), Λ) modq} modp=v (c=hash (C 1 ₁ , C 1 ₂) modq)

by using the public keys A, B of the system and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), and then stop key sharing unless the verification equation is satisfied and, if the verification equation is satisfied,

(6) the respective terminals j calculate

(C 1 ₁γ^(1j) C 1 ₂γ^(2j)){circumflex over ( )}{λ(j, Λ) modq}×C 2 _(i1){circumflex over ( )}(λ(i ₁, Λ) modq)× . . . ×C 2 _(id){circumflex over ( )}{λ(i _(d), Λ) modq} modp

by using λ(j, Λ), (λ(i₁, Λ), . . . , λ(i_(d), Λ), the preparatory information C1 ₁, C1 ₂, the exclusive information C2 _(i1), . . . , C2 _(id), and the own secret information γ1 _(j), γ2 _(j), to thus obtain the common key K. Therefore, the terminals except the particular terminals can perform the key sharing while keeping the higher security.

In addition, as described above, according to the present invention, the exclusive key sharing method for a communication system which consists of the base station and N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication is constructed such that the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, and the number of terminals which can be specified by the base station (referred to as a “particular terminal number” hereinafter) is 1,

respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

(where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and

the base station holds (S, p, g, S₁, . . . , S_(N)),

(1) the base station calculates preparatory information

C ₁ =g ^(k) modp

where an element of GF(p) is g and a non-zero element of GF(q) is k,

(2) the base station calculates exclusive information

C ₂ =g{circumflex over ( )}(k×S _(a) modq) modp,

based on the secret information S_(a) of the particular terminal a, and broadcasts the exclusive information together with the particular terminal number a and the preparatory information C₁ to all terminals, and

(3) the base station calculates a common key

K=g{circumflex over ( )}(k×S modq) modp

which is shared with all terminals j (j≠a) except the particular terminal a,

(4) the respective terminals j (j ≠a) calculate a product

C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C₂{circumflex over ( )}(λ(a, Λ) modq) modp

of a power residue value of C₁

C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) mod q) modp

which uses a product of S_(j) and λ(j, Λ) to the modulus q as an exponent and a power residue value of C₂

C ₂{circumflex over ( )}(λ(a, Λ) modq) modp

which uses λ(a, Λ) calculated to the modulus p as the exponent by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain the common key K which is shared with the base station, and

(i) the base station generates arbitrarily the non-zero element e of GF(q), and broadcasts the e to all terminals,

(ii) the base station calculates the new element

g′=g ^(1/e modq) modp

and replaces the managed element g with it,

(iii) the respective terminals i calculate the new secret information

S _(i) ′=S _(i) ×e modq

(at this time, (g′)^(Si′) modp=(g)^(Si) modp is satisfied). Therefore, since an amount of communication required for the base station is small such as the e and the public information other than the system parameter element g are not changed, such an advantage can be achieved that update of the secret information can be performed at high speed.

Also, the exclusive key sharing method for the communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that

(i) the system manager generates arbitrarily the non-zero element e of GF(q), and broadcasts the e to all terminals,

(ii) the system manager calculates the new element

g′=g ^(1/e modq) modp

and replaces the managed element g with it, and

(iii) the respective terminals i calculate the new secret information

S _(i) ′=S _(i) ×e modq

(at this time, (g′)^(Si′) modp=(g)^(Si) modp is satisfied). Therefore, since an amount of communication required for the system manager is small such as the e and the public information other than the system parameter element g are not changed, such an advantage can be achieved that update of the secret information can be performed at high speed.

Also, the exclusive key sharing method for the communication system which consists of the base station and the N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication is constructed such that

(i) the base station generates arbitrarily the non-zero element e of GF(q), and broadcasts the encrypted e encrypted by using the common key K to all terminals,

(ii) the base station calculates the new element

g′=g ^(1/e modq) modp

and replaces the managed element g with it, and

(iii) the respective terminals i decrypt the encrypted e by using the common key K, and calculate the new secret information

S _(i) ′=S _(i) ×e modq

Therefore, since the secret information of the terminals can be updated by using the random number which is distributed using the common key which is shared by the exclusive key sharing, the excluded terminal cannot be returned in the succeeding exclusive key sharing.

Also, the exclusive key sharing method for a communication system which consists of the N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that

(i) the chairman terminal generates arbitrarily the non-zero element e of GF(q), and broadcasts the encrypted e which is encrypted by using the common key K to all terminals,

(ii) the chairman terminal calculates the new element

g′=g ^(1/e modq) modp

and replaces the element g with it,

(iii) the respective terminals j decrypt the encrypted e by using the common key K, and calculate the new secret information

 S _(j) ′=S _(j) ×e modq

Therefore, since the secret information of the terminals can be updated by using the random number which is distributed using the common key which is shared by the exclusive key sharing, the excluded terminal cannot be returned in the succeeding exclusive key sharing.

Also, the exclusive key sharing method for the communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, elements of GF(p) are g, and the particular terminal number which can be specified by the chairman terminal b is 1, respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy

S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)

(where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and

the chairman terminal b can use the public key for all terminals

y=g ^(S) modp

and the public information

y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp,

(1) the chairman terminal b generates the non-zero element k of GF(q), and calculates the preparatory information

C ₁ =g ^(k) modp,

(2) the chairman terminal b calculates the exclusive information

C ₂ =y _(a) ^(k) modp

based on the public information y_(a) of the particular terminal a, and broadcasts the exclusive information together with the particular terminal number a and the preparatory information C₁ to all terminals, and

(3) the chairman terminal b calculates the common key

K=y ^(k) modp,

(4) the respective terminals j (j≠a, b) calculate λ(j, Λ) and λ(a, Λ) where Λ={j, a}, and calculate

C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C ₂{circumflex over ( )}(λ(a, Λ) modq) modp

by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain the common key K. Therefore, the terminals except the chairman terminal are not requested to hold the public information of other terminals and only the chairman terminal can use the public information of other terminals, such an advantage can be achieved that other terminals cannot be designated as the chairman terminal.

Further, as apparent from the above explanation, according to the present invention, the exclusive key sharing method for the communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication is constructed such that the secret keys are S, the prime number which is larger than S and N or the power number of the prime number is p, the measure of (p−1) is q, elements of GF(p) are g, and the particular terminal number which can be specified by the chairman terminal φ is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S_(i), the respective terminals i and the chairman terminal φ can use the public key of the system y=g^(S) modp, the public information y₁=g^(S1) modp, y₂=g^(S2) modp, . . . , y_(N)=g^(SN) modp, and the p, q, and g, (1) the chairman terminal calculates the preparatory information C1=g^(k) modp, (2) the chairman terminal calculates the exclusive information C2 _(i1)=y_(i1){circumflex over ( )}(k×λ(i₁, α) modq) modp, . . . , C2 _(id)=y_(id){circumflex over ( )}(k×λ(i_(d), α) modq) modp based on a set α of the d particular terminals i₁, . . . , i_(d), λ(i₁, α), . . . , λ(i_(d), α) and the public information y_(i1), . . . , y_(id), and broadcasts the exclusive information C2 _(i1), . . . , C2 _(id) together with the preparatory information C1 and the particular terminal number i₁, . . . , i_(d) to all terminals, and (3) the chairman terminal calculates the common key K=y^(k) modp, (4) the respective terminals j (j≠i₁, . . . i_(d), φ) calculate λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}) and T_(j)={Π(j−L)}/j where Λ_(j)={j, i₁, . . . , i_(d)}, calculate cession keys K_(j)=C1{circumflex over ( )}(S_(j)×λ(j, Λ_(j))×T_(j) modq)×C2 _(i1){circumflex over ( )}(λ(i₁, {j, i₁})×T_(j) modq)× . . . ×C2 _(id){circumflex over ( )}(λ(i_(d), {j, i_(d)})×T_(j) modq) modp by using the preparatory information C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j), and calculates K_(j){circumflex over ( )}(1/T_(j) modq) modp

to thus obtain the common key K (=g^(k×S) modp). Therefore, since the inverse element operation which causes increase of the exponent part can be carried out collectively to thus reduce a size of the exponent part, the operation can be performed at high speed. 

What is claimed is:
 1. An exclusive key sharing method for a communication system which consists of a base station and N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, and a number of terminals which can be specified by the base station (referred to as a “particular terminal number” hereinafter) is 1, respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×Si (sum of iεΛ is calculated)  (where Si=S+f1×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), the base station holds (S, p, g, S1, . . . , SN), and (1) the base station calculates preparatory information C 1=g^(k) modp  if an element of GF(p) is g and a non-zero element of GF(q) is k, (2) the base station calculates exclusive information C 2=g{circumflex over ( )}(k×Sa modq) modp,  based on secret information Sa of a particular terminal a and broadcasts it together with a particular terminal number a and the preparatory information C1 to all terminals, (3) the base station calculates a common key K=g{circumflex over ( )}(k×S modq) modp  which is shared with all terminals j (j≠a) other than the particular terminal a, and (4) respective terminals j (j≠a) calculate C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C 2{circumflex over ( )}(λ(a, Λ) modq) modp  which is a product of C 1{circumflex over ( )}(Sj×λ(j, Λ) modq) modp,  which is a power residue value of C1 having a product of Sj and λ(j, Λ) to a modulus q as an exponent, and C 2{circumflex over ( )}(λ(a, Λ) modq) modp  which is a power residue value of C2 having the λ(a, Λ) calculated to the modulus q as an exponent, by using the preparatory information C1, the exclusive information C2, and own secret information Sj to thus obtain the common key K which is common to the base station.
 2. An exclusive key sharing system for a communication system which consists of a base station and N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication, wherein the base station includes a first base station side storing portion for holding a modulus p which is a prime number which is larger than a secret key S and the N or a power number of the prime number, an element g of GF(p), and an element k of GF(q) having q as a measure of (p−1), a second base station side storing portion for holding secret information S1, . . . , SN to satisfy S=Σλ(i, Λ)×Si (sum of iεΛ is calculated)  (where Si=S+f1×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and a third base station side storing portion for holding a secret key S, and respective terminals i include a first terminal side storing portion for holding (p, g), and a second terminal side storing portion for holding the secret information Si in secret, and (1) the base station also includes a first base station side calculating portion for calculating preparatory information C 1=g ^(k) modp  by using (k, p, q, g) saved in the first base station side storing portion, (2) the base station also includes a controlling portion for designating a particular terminal a, a second base station side calculating portion for outputting secret information Sa saved in the second base station side storing portion under control of the controlling portion and then calculating exclusive information C 2=g{circumflex over ( )}(k×Sa modq) modp  based on the secret information Sa and the (k, p, q, g), and a transmitting portion for broadcasting it together with the preparatory information C1 and a particular terminal number a to all terminals, (3) the base station also includes a third base station side calculating portion for calculating a common key K=g{circumflex over ( )}(k×S modq) modp  which is shared with all terminals j (j≠a) other than the particular terminal a by using the (k, p, q) and the secret key S saved in the third base station side storing portion, and (4) respective terminals j (j≠a) include a terminal side calculating portion for calculating C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C 2{circumflex over ( )}(λ(a, Λ) modq) modp  which is a product of a power residue value of C1 C 1{circumflex over ( )}(Sj×λ(j, Λ) modq) modp  and a power residue value of C2 C 2{circumflex over ( )}(λ(a, Λ) modq) modp  to thus obtain the common key K which is common to the base station.
 3. An exclusive key sharing method for a communication system which consists of a base station and N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, and a particular terminal number is d (1≦d<N−1), and respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×Si (sum of iεΛ is calculated)  (where Si=S+f1×i+ . . . +fd×i^(d) modq (f1, . . . , fd are d elements of GF(q), fd≠0), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated, and Λ is a set of any (d+1) terminals out of the N terminals), the base station holds (S, p, g, S1, . . . , SN), and (1) the base station calculates preparatory information C 1=g ^(k) modp (k is a non-zero element of GF(q)), (2) the base station calculates exclusive information C 21=g{circumflex over ( )}(k×Si 1 modq) modp, . . . , C 2 d=g{circumflex over ( )}(k×Sid modq) modp  based on secret information Si1, . . . , Sid of d particular terminals i1, . . . , id, and then broadcasts them together with the preparatory information C1 and particular terminal numbers i1, . . . , id to all terminals, (3) the base station calculates a common key K=g{circumflex over ( )}(k×S modq) modp  which is shared with all terminals j (j≠i1, . . . , id) other than the particular terminals i1, . . . , id, and (4) respective terminals j (j≠i1, . . . , id) calculate λ(i, Λ), λ(i 1, Λ), . . . , λ(id, Λ)  where Λ={j, i1, . . . , id}, and calculate C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C 21{circumflex over ( )}(λ(i 1, Λ) modq)× . . . ×C 2 d{circumflex over ( )}(λ(id, Λ) modq) modp  by using the preparatory information C1, the exclusive information C21, . . . , C2 d, and own secret information Sj to thus obtain the common key K which is common to the base station.
 4. An exclusive key sharing method for a communication system which consists of a base station and N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, a particular terminal number is d (1≦d<N−1), and a number D of terminals specified actually by the base station (referred to as “actual particular terminal number” hereinafter) in sharing a key is set to a number which is smaller than the particular terminal number d but more than 1, and respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×Si (sum of iεΛ is calculated)  (where Si=S+f1×i+ . . . +fd×i^(d) modq (f1, . . . , fd are d elements of GF(q), fd≠0), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any (d+1) terminals out of the N terminals), and the base station holds secret information SN+1, . . . , SN+d−1 which are divided by calculating SN+1=S+f 1×(N+1)+ . . . +fd×(N+1)^(d) modq, . . . , SN+d−1=S+f 1×(N+d−1)+ . . . +fd×(N+d−1)^(d) modq,  secret information S1, . . . , SN, the secret key S, the modulus p, and the element g of GF(p), and then (1) the base station calculates preparatory information  C 1 =g ^(k) modp (k is a non-zero element of GF(q)), (2) the base station calculates exclusive information C 21 =g{circumflex over ( )}(k×Si 1 modq) modp, . . . , C 2 D=g{circumflex over ( )}(k×SiD modq) modp, C 2 b 1 =g{circumflex over ( )}(k×Sb 1 modq) modp, . . . , C 2 bv=g{circumflex over ( )}(k×Sbv modq) modp,  based on secret information Si1, . . . , SiD of D particular terminals i1, . . . , iD and any v (=d−D) secret information Sb1, . . . , Sbv out of the secret information SN+1, . . . , SN+d−1, and then broadcasts the exclusive information C21, . . . , C2D, and C2 b 1, . . . , C2 bv, the preparatory information C1, particular terminal numbers i1, . . . , iD, and numbers b1, . . . , bv of the secret information Sb1, . . . , Sbv to all terminals, (3) the base station calculates a common key K=g{circumflex over ( )}(k×S modq) modp  which is shared with all terminals j (j≠i1, . . . , iD) other than the particular terminals i1, . . . , iD, and (4) respective terminals j (j≠i1, . . . , iD) calculate λ (j, Λ), λ(i1, Λ), . . . , λ(iD, Λ), λ(ib1, Λ), . . . , λ(ibv, Λ) where Λ={j, i1, . . . , iD, b1, . . . , bv}, and calculate a product C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)× C 21{circumflex over ( )}(λ(i 1, Λ) modq)× . . . ×C 2 D{circumflex over ( )}(λ(iD, Λ) modq)×Cb 1{circumflex over ( )}(λ(b 1, Λ) modq)× . . . ×Cbv{circumflex over ( )}(λ(bv, Λ) modq) modp  of a power residue value C1{circumflex over ( )}(Sj×λ(j, Λ) modq) and a power residue value C 21{circumflex over ( )}(λ(i 1, Λ) modq)× . . . ×C 2 D{circumflex over ( )}(λ(iD, Λ) modq)×Cb 1{circumflex over ( )}(λ(b 1, Λ) modq)× . . . ×Cbv{circumflex over ( )}(λ(bv, Λ) modq) modp  by using the preparatory information C1, the exclusive information C21, . . . , C2D, C2 b 1, . . . , C2 bv, and own secret information Sj to thus obtain the common key K which is common to the base station.
 5. An exclusive key sharing method according to claim 3, wherein the base station holds e sets of secret information which are obtained by dividing the secret key S into any e particular terminals d1, . . . , de (e is an integer) respectively, the respective terminals hold e pieces of secret information out of respective sets which correspond to own terminal number, and when key sharing is carried out to exclude the particular terminals, the base station and the respective terminals j select a particular terminal number dw (1≦w≦e) which is equal to the actual particular terminal number D from the particular terminals d1, . . . , de, and then the base station broadcasts the preparatory information and the exclusive information by using a set of secret information corresponding to the selected particular terminal number dw to obtain a common key K shared with the terminals, while the respective terminals j obtain the common key K shared with the base station by using the secret information corresponding to the particular terminal number dw.
 6. An exclusive key sharing method according to claim 1, wherein the secret key S is set as a secret key for all terminals, and a power residue value of the g y=g ^(S) modp which has S as the exponent and p as the modulus is set as a public key for all terminals, and the base station holds divided secret information S1, S2, . . . , SN of all terminals in secret, and (1) the base station generates arbitrarily an integer k, and calculates preparatory information C 1 =g ^(k) modp (k is a non-zero element of GF(q))  as a power residue value of the element g which has k as the exponent and p as the modulus (2) the base station calculates a product of the secret information Sa of the particular terminal a and the k, and then calculates exclusive information C 2 =g{circumflex over ( )}(k×Sa modq) modp  which has this information as the exponent, p as the modulus, and g as a base, (3) the base station calculates a common key K=y ^(k) modp  as a power residue value of the public key y for all terminals which has k as the exponent and p as the modulus and simultaneously generates arbitrarily common data M to the respective terminals j (j≠a), then calculates a product of M and the common key K to the modulus p (referred to as a “ciphertext” hereinafter) C 3 =M×K modp,  and then broadcasts this ciphertext together with the preparatory information C1 and the particular terminal number a to all terminals, (4) the respective terminals j (j≠a) calculate λ(j, Λ) and λ(a, Λ) where Λ={j,a}, then calculate a product K=C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C 2{circumflex over ( )}(λ(a, Λ) modq) modp  of a power residue value C 1{circumflex over ( )}(Sj×λ(j, Λ) modq) modp  which has a product of Sj and λ(j, Λ) to the modulus q as an exponent and the C1 as the base and a power residue value C 2{circumflex over ( )}(λ(a, Λ) modq) modp  which has λ(a, Λ) to the modulus q as the exponent and the C2 as the base by using the preparatory information C1, the exclusive information C2, and own secret information Sj, and then calculate a value which is obtained by dividing the ciphertext C3 by K to the modulus p C 3 /K modp=M×K/K modp  as the common data M to the base station.
 7. An exclusive key sharing method according to claim 1, wherein a power residue value of the g y=g ^(s) modp  which has a secret key S for all terminals as an exponent and p as the modulus is set as a public key for all terminals, and the base station can use public information y 1=g ^(S1) modp, y 2=g ^(S2) modp, . . . , yN=g ^(SN) modp  as power residue values of g which have divided secret information S1, S2, . . . , SN of all terminals as the exponent respectively and p as the modulus, and (1) the base station generates arbitrarily an integer k and then calculates preparatory information C 1 =g ^(k) modp (k is a non-zero element of GF(q))  as a power residue value of g which has k as the exponent and p as the modulus (2) the base station calculates exclusive information C 2=ya ^(k) modp  as a power residue value of the public information ya of the particular terminal a which has k as the exponent and p as the modulus, (3) the base station calculates a common key K=y ^(k) modp=g{circumflex over ( )}(S×k) modp  as a power residue value of the public key y for all terminals which has k as the exponent and p as the modulus, and simultaneously generates arbitrarily common data M to the respective terminals j (j≠a), then calculates a ciphertext C 3=M×K modp,  as a product of M and the K to the modulus p, and then broadcasts this ciphertext together with the preparatory information C1 and the particular terminal number a to all terminals, (4) the respective terminals j (j≠a) calculate λ(j, Λ) and λ(a, Λ) where Λ={j,a}, then calculate a product K=C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C 2{circumflex over ( )}(λ(a, Λ) modq) modp  of a power residue value of C1 C 1{circumflex over ( )}(Sj×λ(j, Λ) modq) modp  which has a product of Sj and λ(j, Λ) to the modulus q as an exponent and a power residue value of C2 C 2{circumflex over ( )}(λ(a, Λ) modq) modp  which has λ(a, Λ) to the modulus q as the exponent by using the preparatory information C1, the exclusive information C2, and own secret information Sj, and then calculate a value which is obtained by dividing the ciphertext C3 by K to the modulus p C 3 /K=M×K/K modp  as the common data M to the base station.
 8. An exclusive key sharing method according to claim 1, wherein the secret key S is set as a secret key for the base station, and a power residue value of the g y=g ^(S) modp  which has the S as an exponent and p as the modulus is set as a public key for the base station (this public key is not opened for terminals), and the respective terminals hold one of divided secret information S1, S2, . . . , SN of the secret key S of the base station in secret, the base station can use public information y 1=g ^(S1) modp, y 2=g ^(S2) modp, . . . , yN=g ^(SN) modp  as power residue values of g which have divided secret information S1, S2, . . . , SN of all terminals as the exponent respectively and p as the modulus, and (1) the base station (1-a) generates arbitrarily an integer k, and calculates a power residue value of g C 0 =g{circumflex over ( )}(−k modq) modp  which has (−k) calculated to the modulus q as the exponent and the p as the modulus, (1-b) generates common data M to all terminals j (j≠a) other than the particular terminal a, and then calculates a product of the M and the C0 to the modulus p r=M×C 0 modp, (1-c) calculates a residue obtained by dividing the r by the q r′=r modq, (1-d) calculates a value s to satisfy k=s−r′×S modq  by using R′, k, the secret key S of the base station, (1-e) calculates preparatory information C 1 =g{circumflex over ( )}(−r modq) modp  as a power residue value of g which has (−r) calculated to the modulus q as the exponent and p as the modulus, (1-f) calculates exclusive information C 2 =ya{circumflex over ( )}(−r modq) modp  as a power residue value of ya which has (−r) calculated to the modulus q as the exponent and p as the modulus by using a public information ya of the particular terminal a, and (1-g) broadcasts (r,s) together with C1, C2 to all terminals as a signature of M, (2) the respective terminals j (j≠a) calculate λ(j, Λ) and λ(a, Λ) where Λ={j,a}, then calculate a product K=C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C 2{circumflex over ( )}(λ(a, Λ) modq) modp  of a power residue value of C1 C 1{circumflex over ( )}(Sj×λ(j, Λ) modq) modp  which has a product of Sj and λ(j, Λ) to the modulus q as an exponent and a power residue value of C2 C 2{circumflex over ( )}(λ(a, Λ) modq) modp  which has λ(a, Λ) to the modulus q as the exponent by using the preparatory information C1, the exclusive information C2, and own secret information Sj, and then calculate a product of a power residue value of g having s as the exponent, r, and K to the modulus p r×g ^(s) ×K modp  to obtain the common data M.
 9. An exclusive key sharing method according to claim 1, wherein a power residue value of the g y=g ^(S) modp  which has a secret key S for all terminals as an exponent and p as the modulus is set as a public key for all terminals, and the base station can use public information y 1=g ^(S1) modp, y 2=g ^(S2) modp, . . . , yN=g ^(SN) modp  as power residue values of g which have divided secret information S1, S2, . . . , SN of all terminals as the exponent respectively and p as the modulus, and (1) the base station generates arbitrarily an integer k and then calculates preparatory information C 1 =g ^(k) modp (k is a non-zero element of GF(q))  as a power residue value of the g which has k as the exponent and p as the modulus, (2) the base station calculates exclusive information C 2=ya ^(k) modp  as a power residue value of the public information ya of the particular terminal a which has k as the exponent and p as the modulus, (3) the base station calculates a power residue value of the public key y for all terminals, which has k as the exponent and p as the modulus, as a common key K=y ^(k) modp  to all terminals j (j≠a) other than the particular terminal a, (4) the respective terminals j calculate a product of a power residue value of C1, which has a product of Sj and λ(j, Λ) to the modulus q as an exponent, and a power residue value of C2, which has λ(a, Λ) calculated to the modulus q as the exponent C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C 2{circumflex over ( )}(λ(a, Λ) modq) modp,  by using the preparatory information C1, the exclusive information C2, and own secret information Sj to thus obtain the common key K to the base station.
 10. An exclusive key sharing method according to claim 1, wherein the respective terminals hold secret information S1, . . . , SN in secret, and a set of any t terminals (t is more than 2) out of the N terminals is assumed as Λ, and (1) the base station calculates preparatory information C 1=g ^(k) modp  which has an integer k as the exponent, p as the modulus, and g as a base, (2) the base station calculates shared information Xij which satisfy a following expression for any ij (j=1, . . . , t) of t particular terminals i1, . . . , it, Xij=Π(g{circumflex over ( )}(Su×k))modp (product of uεΛ−{ij} is calculated)  and then broadcasts all shared information Xij and the preparatory information C1 to all terminals, (3) the base station calculates K which satisfies a following expression by using secret information Si1, . . . , Sit of the particular terminals K=g ^(x) modp x=k×ΣSij modq (sum of j=1 to t is calculated)  and then sets it as a common key K to the t particular terminals, and (4) the particular terminals ij calculate a product of Xij and a power residue value of C1 Xij×C 1 ^(Sij) modp,  which has p as the modulus and own secret information Sij as the exponent, to the modulus p to thus obtain the common key K to the base station.
 11. An exclusive key sharing method according to claim 1, wherein the base station executes division of the secret key S and then distributes divided the secret keys to corresponding terminals via cipher communicating means which are provided previously between the base station and the terminals.
 12. An exclusive key sharing method according to claim 9, wherein a third party which is different from the base station executes division of the secret key S, calculation and publication of a power residue value and public information y1, y2, . . . , yN, and allocation of corresponding Sa to the terminal a.
 13. An exclusive key sharing method according to claim 1, wherein the respective terminals i (1≦i≦N) hold the secret information Si in secret, the respective terminals i can use power residue values of g which has integers f0(=S), f1, . . . , fd as the exponent respectively and p as the modulus (referred to as “verification information” hereinafter) g^(f0), g^(f1), . . . , g^(fd), and the respective terminals a execute following calculation g ^(Si)=Π(g{circumflex over ( )}(fj×a ^(j))) modp (product of j=0 to d is calculated) by using the verification information and own secret information Si, and then check validity of own secret information Si by deciding whether or not both sides are equal to each other.
 14. An exclusive key sharing method according to claim 1, wherein new terminal numbers I (I>N) are set to terminals which newly enter into the communication system which can execute the broadcast communication, and then secret information SI which are obtained by calculating SI=S+f 1×I are held in new terminal in secret.
 15. An exclusive key sharing method according to claim 1, wherein the terminal i saves in secret a power residue of C1 (=C1 ^(Si) modp) which has p in place of the secret information Si as the modulus and Si as the exponent.
 16. An exclusive key sharing method according to claim 1, wherein the base station calculates λ(j, Λ) for all Λ's including the particular terminals, then calculates a power residue value of the exclusive information C2 C 2{circumflex over ( )}(λ(i, Λ) modq) modp which has λ(i, Λ) calculated to the modulus q as the exponent and p as the modulus, then broadcasts it in sharing the key, and all terminals j (j≠a) except the particular terminal a obtain the common key K by using the power residue value C 2{circumflex over ( )}(λ(i, Λ) modq) modp  in response to the Λ's including the j.
 17. An exclusive key sharing method according to claim 1, wherein all terminals j (j≠a) except the base station and the particular terminal a generate a new common key K2 based on the shared common key K and the common key K1 shared at a time of previous key sharing.
 18. An exclusive key sharing method according to claim 1, wherein a digital signature of the base station is added to data which are distributed from the base station by a digital signature means provided previously to the base station and the terminals.
 19. An exclusive key sharing method according to claim 2, wherein areas of the first, second, and third base station side storing portions of the base station and the first and second terminal side storing portions of the terminals are not observed and modified from an outside.
 20. An exclusive key sharing method according to claims 1 or 10, wherein it can be selected automatically that the exclusive key sharing method set forth in claim 1 is applied if a scale of constituting groups exceeds half of all terminals and the exclusive key sharing method set forth in claim 10 is applied unless the scale of constituting groups exceeds half of all terminals.
 21. An exclusive key sharing method according to claim 1, wherein a number of secret information held by the terminals is increased and decreased in response to authority of the terminals.
 22. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal (to which any terminal can be appointed) is 1, respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×Si (sum of iεΛ is calculated)  (where Si=S+f1×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and the base station can use a public key for all terminals y=g ^(S) modp,  and public information y 1=g ^(S1) modp, y 2=g ^(S2) modp, . . . , yN=g ^(SN) modp,  and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q) and then calculates preparatory information C 1=g ^(k) modp, (2) the chairman terminal calculates exclusive information C 2=ya ^(k) modp  based on the public information ya of the particular terminal a, and broadcasts this exclusive information together with the particular terminal number a and the preparatory information C1 to all terminals, (3) the chairman terminal calculates a common key  K=y ^(k) modp, (4) the respective terminals j (j≠a) calculate λ(j, Λ) and λ(a, Λ) where Λ={j,a}, and calculate C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C 2{circumflex over ( )}(λ(a, Λ) modq) modp  by using the preparatory information C1, the exclusive information C2, and own secret information Sj to thus obtain a common key K.
 23. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, and elements of GF(p) are g, respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×Si (sum of iεΛ is calculated)  (where Si=S+f1×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and can use a public key for all terminals y=g ^(S) modp,  public keys for respective terminals y 1=g ^(S1) modp, y 2=g ^(S2) modp, . . . , yN=g ^(SN) modp,  and (1) a certain terminal a generates arbitrarily a non-zero element k of GF(q) and then calculates preparatory information C 1=g ^(k) modp, (2) the certain terminal a calculates exclusive information C 2=ya ^(k) modp  based on own public key ya, and broadcasts this exclusive information together with a terminal number a and the preparatory information C1 to all terminals, (3) the certain terminal a calculates a common key K=y ^(k) modp, (4) the respective terminals j (j≠a) calculate λ(j, Λ) and λ(a, Λ) where Λ={j,a}, and calculate C 1{circumflex over ( )}(Sj×λ(j, Λ) modq)×C 2{circumflex over ( )}(λ(a, Λ) modq) modp  by using the preparatory information C1, the exclusive information C2, and own secret information Sj to thus obtain the common key K.
 24. An exclusive key sharing method according to claim 22, wherein respective terminals hold all public keys other than own public key.
 25. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated) λ(i, Λ)=Π{L/(L−i)}(product of LεΛ−{i} is calculated) S _(i)=S+f₁ ×i ¹ + . . . +f _(d) ×i ^(d) modq  (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use a public key of the system y=g ^(S) modp,  public information y 1=g^(S1) modp, y 2=g ^(S2) modp, . . . , yN=g ^(SN) modp,  the prime number p, the measure q and the elements g, and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q) and then calculates exclusive information C 2 _(i1) =y _(i1) ^(k) modp, . . . , C 2 _(id) =y _(id) ^(k) modp  based on the public information y_(i1), . . . , y_(id) of the d terminals i₁, . . . , i_(d), (2) the chairman terminal calculates a signature Z=C 2 _(i1) × . . . ×C 2 _(id)×(−S _(φ))+k modq  by using own secret information S_(φ), and broadcasts the signature Z together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d) and own terminal number φ to all terminals, (3) the chairman terminal calculates a common key K=y ^(k) modp, (4) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate C 1 =g ^(z) ×y _(φ){circumflex over ( )}(C 2 _(i1) × . . . ×C2 _(id) modq) modp (if a signer is surely the chairman terminal φ and also the signature Z, the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d), and the terminal number φ of the chairman terminal are not tampered, C1=g^(k) modp is calculated) by using the public information y_(φ) of the chairman terminal, (5) the respective terminals j calculate λ(j, Λ) and λ(i₁, Λ), . . . , λ(i_(d), Λ) where Λ={j, i₁, . . . , i_(d)}, and calculate C1{circumflex over ( )}(S_(j)×λ(j, Λ) modq)×C2 _(i1){circumflex over ( )}(λ(i₁, Λ) modq)× . . . ×C2 _(id){circumflex over ( )}(λ(i_(d), Λ) modq) modp by using the C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j) to thus obtain the common key K.
 26. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, according to claim 25, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d≦N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) S _(i) =S+f ₁ ×i ¹ + . . . +f _(d) ×i ^(d) modq  (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use a public key of the system y=g ^(S) modp,  public information y 1=g ^(S1) modp, y 2=g ^(S2) modp, . . . , yN=g ^(SN) modp,  a Hash function hash ( ), the prime number p, the measure q, and the elements g, and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q) and then calculates exclusive information C 2 _(i1) =y _(i1) ^(k) modp, . . . , C 2 _(id) =y _(id) ^(k) modp  based on the public information y_(i1), . . . , y_(id) of the d terminals i₁, . . . , i_(d), (2) the chairman terminal calculates a hash value H=hash(C 2 _(i1) , . . . , C 2 _(id))  which is obtained by compressing the exclusive information C2 _(i1), . . . , C2 _(id) by using the Hash function hash( ), (3) the chairman terminal calculates a signature Z=H×(−S _(φ))+k modq  by using own secret information S_(φ), and then broadcasts the signature Z together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d) and own terminal number φ to all terminals, (4) the chairman terminal calculates a common key K=y ^(k) modp, (5) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate a hash value H′ which is obtained by compressing the exclusive information C2 _(i1), . . . , C2 _(id) by using the Hash function hash ( ), (6) the respective terminals j calculate C 1 =g ^(z) ×y _(φ) ^(H′) modp (if a signer is surely the chairman terminal φ and also the signature Z, the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d), and the terminal number φ of the chairman terminal are not tampered, C1=g^(k) modp and H′=H are calculated) by using the public information y_(φ) of the chairman terminal, (7) the respective terminals j calculate λ(j, Λ) and λ(i₁, Λ). . . λ(i_(d), Λ) where Λ={j, i₁, . . . , i_(d)}, and calculate C1{circumflex over ( )}(S_(j)×λ(j, Λ) modq)×C2 _(i1){circumflex over ( )}(λ(i₁, Λ) modq)× . . . ×C2 _(id){circumflex over ( )}(λ(i_(d), Λ) modq) modp by using the C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j) to thus obtain the common key K.
 27. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, according to claims 25 or 26, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), and a number D of terminals which the chairman terminal actually specifies in sharing a key (referred to as an “actual particular terminal number” hereinafter) is a number which is smaller than the particular terminal number but larger than 1, respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iελ is calculated) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) S ₁ =S+f ₁ ×i ¹ + . . . +f _(d) ×i ^(d) modq  (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use secret information S_(N+1), . . . , S_(N+d−1) which are divided by calculating S _(N+1) =S+f ₁×(N+1)+ . . . +f×(N+1)^(d) modq, . . . , S _(N+d−1) =S+f ₁×(N+d−1)¹ + . . . +f _(d)×(N+d−1)^(d) modq,  public information y ₁ =g ^(S1) modp, . . . , y _(N) =g ^(SN) modp, . . . , y _(N+1) =g ^(SN+1) modp, . . . , y _(N+d−1) =g ^(SN+d−1) modp,  which are calculated by the secret information S₁, . . . , S_(N), a public key of the system y=g ^(s) modp,  the prime number p, the measure q, and the elements g, and (1) the chairman terminal calculates exclusive information C 2 _(i1) =y _(i1) ^(k) modp, . . . , C 2 _(iD) =y _(iD) ^(k) modp, C 2 _(b1) =y _(b1) ^(k) modp, . . . , C 2 _(bv) =y _(bv) ^(k) modp (k is a non-zero element of GF(q))  based on the public information y_(i1), . . . , y_(iD) of the D particular terminals i₁, . . . , i_(D), and any v(=d−D) public information y_(b1), . . . , y_(bv) out of the public information y_(N+1), . . . , y_(N+d−1), (2) the chairman terminal calculates a signature Z=C 2 _(i1) × . . . ×C 2 _(iD) ×C 2 _(b1) × . . . ×C 2 _(bv)×(−S _(φ))+k modq  by using own secret information S_(φ), and then broadcasts the signature Z together with the exclusive information C2 _(i1), . . . , C2 _(iD), C2 _(b1), . . . , C2 _(bv) the particular terminal numbers i₁, . . . , i_(D), the terminal numbers b₁, . . . , b_(v), and own terminal number φ to all terminals, (3) the chairman terminal calculates a common key K=y ^(k) modp  which is shared with all terminals j (j≠i₁, . . . , i_(D), b₁, . . . , b_(v), φ) except the particular terminals i₁, . . . , i_(D), (4) the respective terminals j calculate  C 1 =g ^(z) ×y _(φ){circumflex over ( )}(C 2 _(i1) × . . . ×C 2 _(iD) ×C 2 _(b1) × . . . ×C 2 _(bv) modq) modp  (if a signer is surely the chairman terminal φ and also the signature Z, the exclusive information C2 _(i1), . . . , C2 _(iD), C2 _(b1), . . . , C2 _(bv), the particular terminal numbers i₁, . . . , i_(D), the terminal numbers b₁, . . . , b_(v) corresponding to the public information y_(b1), . . . , y_(bv), and the terminal number φ of the chairman terminal are not tampered, C1=g^(k) modp is calculated) by using the public information y_(φ) of the chairman terminal, (5) the respective terminals j calculate λ(j, Λ), λ(i₁, Λ), . . . , λ(i_(D), Λ), λ(b₁, Λ), . . . , λ(b_(v), Λ) where Λ={j, i₁, . . . , i_(d), b₁, . . . , b_(v)}, and calculate a product C1{circumflex over ( )}(S_(j)×λ(j, Λ) modq)×C2 _(i1){circumflex over ( )}(λ(i₁, Λ) modq)× . . . ×C2 _(iD){circumflex over ( )}(λ(i_(D), Λ) modq)×C2 _(b1){circumflex over ( )}(λ(b₁, Λ) modq)× . . . ×C2 _(bv){circumflex over ( )}(λ(i, Λ) modq) modp of a power residue value C1{circumflex over ( )}(S_(j)×λ(j, Λ) modq) and a power residue value C2 _(i1){circumflex over ( )}(λ(i₁, Λ) modq)× . . . ×C2 _(iD){circumflex over ( )}(λ(i_(D), Λ) modq)×C2 _(b1){circumflex over ( )}(λb₁, Λ) modq)× . . . ×C2 _(bv){circumflex over ( )}(λ(i_(v), Λ) modq) to the modulus p by using the C1, the exclusive information C2 _(i1), . . . , C2 _(id), C2 _(b1), . . . , C2 _(bv), and own secret information S_(j) to thus obtain the common key K which is shared with the base station.
 28. An exclusive key sharing method according to claims 25 or 26, wherein the chairman terminal can use public information formulated based on θ sets of secret information, which are derived by dividing the secret key S to the θ particular terminal numbers d₁, . . . , d_(θ) (θ is any integer) respectively, and the terminal holds θ pieces of secret information, which correspond to own terminal number, out of respective sets, and when key sharing is carried out to exclude the particular terminals, the chairman terminal and the respective terminals j select a particular terminal number d_(w) (1≦w≦θ), which is equal to the actual particular terminal number D, from the particular terminals d₁, . . . , d₀, and then the chairman terminal broadcasts the signature, the exclusive information, the particular terminal number, and the own terminal number, by using a set of public information corresponding to the selected particular terminal number d_(w) to obtain a common key K which is shared with the terminals, and the terminals j verify the signature and obtain the common key K which is shared with the chairman terminal by using the secret information corresponding to the d_(w).
 29. An exclusive key sharing method for a communication system which consists of base station and N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication, according to claims 25 or 26, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) S ₁ =S+f ₁ ×i ¹ + . . . +f _(d) ×i ^(d) modq  (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1)terminals out of the N terminals), the base station μ holds all secret information S_(i) in secret, the respective terminals i and the base station μ can use public information of the base station y _(μ) =g ^(Sμ) modp,  the prime number p, the measure q, and the elements g, and (1) the base station generates arbitrarily a non-zero element k of GF(q), and calculates exclusive information C 2 _(i1) =y _(i1) ^(k) modp, . . . , C 2 _(id) =y _(id) ^(k) modp  based on the public information y_(i1), . . . , y_(id) of the d particular terminals i₁, . . . , i_(d), (2) the base station calculates a signature Z=C 2 _(i1) × . . . ×C2 _(id)×(−S _(μ))+k modq  by using own secret information S_(μ), and broadcasts the signature Z together with the exclusive information C2 _(i1), . . . , C2 _(id) and the particular terminal numbers i₁, . . . , i_(d) to all terminals, (3) the base station calculates a common key K=g{circumflex over ( )}(k×S modq) modp, (4) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate C 1 =g ^(z) ×y _(μ){circumflex over ( )}(C2 _(i1) × . . . ×C 2 _(id) modq) modp (if a signer is surely the base station μ and also the signature Z, the exclusive information C2 _(i1), . . . , C2 _(id), and the particular terminal numbers i₁, . . . , i_(d) are not tampered, C1=g^(k) modp is calculated) by using the public information y_(μ) of the base station, (5) the respective terminals j calculate λ(j, Λ) and λ(i₁, Λ), . . . , λ(i_(d), Λ) where Λ={j, i₁, . . . , i_(d) }, and calculate C1{circumflex over ( )}(S_(j)×λ(j, Λ) modq)×C2 _(i1){circumflex over ( )}(λ(i₁, Λ) modq)× . . . ×C2 _(id){circumflex over ( )}(λ(i_(d), Λ) modq) modp by using the C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j) to thus obtain the common key K.
 30. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, according to claim 25, wherein secret keys are α1, α2, β1, β2, γ, a prime number which is larger than α1, α2, β1, β2, γ and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g1, g2, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i) in secret to satisfy α1=Σλ(i, Λ)×α1 _(i)(sum of iεΛ is calculated) (where α1 _(i)=α1+f₁×i¹+ . . . +f_(d)×i^(d) modq) α2=Σλ(i, Λ)×α2 _(i)(sum of iεΛ is calculated) (where α2 _(i)=α2+f₁×i¹+ . . . +f_(d)×i^(d) modq) β1=Σλ(i, Λ)×β1 _(i)(sum of iεΛ is calculated) (where β1 _(i)=β1+f₁×i¹+ . . . +f_(d)×i^(d) modq) β2=Σλ(i, Λ)×β2 _(i)(sum of iεΛ is calculated) (where β2 _(i)=β2 +f ₁×i¹+ . . . +f_(d)×i^(d) modq) γ=Σλ(i, Λ)×γ_(i)(sum of iεΛ is calculated) (where γ_(i)=γ+f₁×i¹+ . . . +f_(d)×i^(d) modq) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use public keys of the system A=g ₁ ^(α1) g ₂ ^(α2) modp, B=g ₁ ^(β1) g ₂ ^(β2) modp, Γ=g ₁ ^(γ) modp,  public information A ₁ =g ₁ ^(α11) g ₂ ^(α21) modp, . . . , A _(N) =g ₁ ^(α1N) g ₂ ^(α2N) modp, B ₁ =g ₁ ^(β11) g ₂ ^(β21) modp, . . . , B _(N) =g ₁ ^(β1N) g ₂ ^(β2N) modp, Γ₁ =g ₁ ^(γ1) modp, . . . , Γ _(N) =g ₁ ^(γN) modp  which are calculated by the secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i), the prime number p, the measure q, the elements g1, g2, and a Hash function hash ( ), and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates preparatory information C 1 ₁ =g ₁ ^(k) modp, C 1 ₂ =g ₂ ^(k) modp (2) the chairman terminal calculates exclusive information C 2 _(i1)=Γ_(i1) ^(k) modp, . . . , C 2 _(iD)=Γ_(iD) ^(k) modp, C 2 _(b1)=Γ_(b1) ^(k) modp, . . . , C 2 _(bv)=Γ_(bv) ^(k) modp,  based on the public information Γ_(i1), . . . , Γ_(iD) of the D particular terminals i₁, . . . , i_(D), and any v(=d−D) public information Γ_(b1), . . . , Γ_(bv) out of the public information Γ_(N+1), . . . , Γ_(n+d−1), (3) the chairman terminal calculates verification information v=A ^(k) B{circumflex over ( )}{(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq), v _(i1) =A _(i1) ^(k) B _(i1){circumflex over ( )}{(c×k) modq} modp, . . . , v _(iD) =A _(iD) ^(k) B _(iD){circumflex over ( )}{(c×k) modq} modp  v _(b1) =A _(b1) ^(k) B _(b1){circumflex over ( )}{(c×k) modq} modp, . . . , v _(bv) =A _(bv) ^(k) B _(bv){circumflex over ( )}{(c×k) modq} modp  and then broadcasts the verification information v, v_(i1), . . . , v_(iD), v_(b1), . . . , v_(bv) together with the exclusive information C2 _(i1), . . . , C2 _(iD), C2 _(b1), . . . , C2 _(bv), the particular terminal numbers i₁, . . . , i_(D), and the terminal numbers b₁, . . . , b_(v) corresponding to the public information Γ_(b1), . . . , Γ_(bv) to all terminals, (4) the chairman terminal calculates a common key K=Γ ^(k) modp (5) the respective terminals j (j≠i₁, . . . , i_(D), b₁, . . . , b_(v), φ) calculate λ(j, Λ), λ(i₁, Λ), . . . , λ(i_(D), Λ), λ(b₁, Λ), . . . , λ(b_(v), Λ) where Λ={j, i₁, . . . , i_(D), b₁, . . . , b_(v)}, and then calculate a verification equation {C 1 ₁{circumflex over ( )}((α1 _(j)+β1 _(j) ×c)λ(j, Λ) modq)}{C 1 ₂{circumflex over ( )}((α2 _(j)+β2 _(j) ×c)λ (j, Λ) modq)}×v _(i1){circumflex over ( )}{λ(i ₁, Λ) modq}× . . . ×v _(iD){circumflex over ( )}{λ(i _(D), Λ) modq} modp=v(c=hash (C 1 ₁ , C 1 ₂) modq)  by using the public keys A, B of the system and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), and then stop key sharing unless the verification equation is satisfied and, if the verification equation is satisfied, (6) the respective terminals j calculate C 1 ₁{circumflex over ( )}{γ_(j)×(λ(j, Λ) modq)}×C 2 _(i1){circumflex over ( )}(λ(i ₁, Λ) modq)× . . . ×C 2 _(id){circumflex over ( )}(λ(i _(d), Λ) modq) modp  by using the λ(j, Λ), (λ(i₁, Λ), . . . , λ(i_(d), Λ), the preparatory information C1 ₁, the exclusive information C2 _(i1), . . . , C2 _(id), and the own secret information γ_(j) to thus obtain the common key K.
 31. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, according to claims 25 or 30, wherein secret keys are α1, α2, β1, β2, γ, a prime number which is larger than α1, α2, β1, β2, γ and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g1, g2, a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), and a number D of terminals which the chairman terminal actually specifies in sharing the keys (referred to as an “actual particular terminal number” hereinafter) is a number which is smaller than the particular terminal number d but larger than 1, respective terminals i (1≦i≦N) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i) in secret to satisfy α1=Σλ(i, Λ)×α1 _(i)(sum of iεΛ is calculated) (where α1 _(i)=α1+f₁×i¹+ . . . +f_(d)×i^(d) modq) α2=Σλ(i, Λ)×α2 _(i)(sum of iεΛ is calculated) (where α2 _(i)=α2+f₁×i¹+ . . . +f_(d)×i^(d) modq) β1=Σλ(i, Λ)×β1 _(i)(sum of iεΛ is calculated) (where β1 _(i)=β1+f₁×i¹+ . . . +f_(d)×i^(d) modq) β2=Σλ(i, Λ)×β2 _(i)(sum of iεΛ is calculated) (where β2 _(i)=β2+f₁×i¹+ . . . +f_(d)×i^(d) modq) γ=Σλ(i, Λ)×γ_(i)(sum of iεΛ is calculated) (where γ_(i)=γ+f₁×i¹+ . . . +f_(d)×i^(d) modq) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use public keys of the system A=g ₁ ^(α1) g ₂ ^(α2) modp, B=g ₁ ^(β1) g ₂ ^(β2) modp, Γ=g ₁ ^(γ) modp,  public information A _(N+1) =g ₁ ^(α1N+1) g ₂ ^(α2N+1) modp, A _(N+d−1) =g ₁ ^(α1N+d−1) g ₂ ^(α2N+d−1) modp B _(N+1) =g ₁ ^(β1N+1) g ₂ ^(β2N+1) modp, . . . , B _(N+d−1) =g ₁ ^(β1N+d−1) g ₂ ^(β2N+d−1) modp Γ_(N+1) =g ₁ ^(γN+1) modp, . . . ,  Γ_(N+d−1) =g ₁ ^(γN+d−1) modp,  which are calculated by the secret information α1 _(N+1), . . . , α1 _(N+d−1), α2 _(N+1), . . . , α2 _(N+d−1), β1 _(N+1), . . . , β1 _(N+d−1), β2 _(N+1), . . . , β2 _(N+d−1), γ_(N+1), . . . , γ_(N+d−)1, which are divided by calculating α1 _(N+1)=α1 +f ₁×(N+1)¹ + . . . , +f _(d)×(N+1)^(d) modq, . . . , α1 _(N+d−1)=α1 +f ₁×(N+d−1)¹ + . . . , +f _(d)×(N+d−1)^(d) modq, β1 _(N+1)=β1 +f ₁×(N+1)¹ + . . . , +f _(d)×(N+1)^(d) modq, . . . , β1 _(N+d−1)=β1 +f ₁×(N+d−1)¹ + . . . , +f _(d)×(N+d−1)^(d) modq, γ_(N+1) =γ+f ₁×(N+1)¹ + . . . , +f _(d)×(N+1)^(d) modq, . . . , γ_(N+d−1) =γ+f ₁×(N+d−1)¹ + . . . , +f _(d)×(N+d−1)^(d) modq, α2 _(N+1)=α1 +f ₁×(N+1)¹ + . . . , +f _(d)×(N+1)^(d) modq, . . . , α2 _(N+d−1)=α1 +f ₁×(N+d−1)¹ + . . . , +f _(d)×(N+d−1)^(d) modq, β2 _(N+1)=β1 +f ₁×(N+1)¹ + . . . , +f _(d)×(N+1)^(d) modq, . . . , β2 _(N+d−1)=β1 +f ₁×(N+d−1)¹ + . . . , +f _(d)×(N+d−1)^(d) modq,  public information A ₁ =g ₁ ^(α11) g ₂ ^(α21) modp, . . . , A _(N) =g ₁ ^(α1N) g ₂ ^(α2N) modp B ₁ =g ₁ ^(β11) g ₂ ^(β21) modp, . . . , B _(N) =g ₁ ^(β1N) g ₂ ^(β2N) modp Γ₁ =g ₁ ^(γ1) modp, . . . , Γ _(N) =g ₁ ^(γN) modp  which are calculated by the secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i), the prime number p, the measure q, the elements g1, g2, and a Hash function hash ( ), and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates preparatory information C 1 ₁ =g ₁ ^(k) modp, C1 ₂=g₂ ^(k) modp (2) the chairman terminal calculates exclusive information C2 _(i1)=Γ_(i1) ^(k) modp, . . . , C 2 _(id)=Γ_(id) ^(k) modp  based on the public information Γ_(i1), . . . , Γ_(id) of the d particular terminals i₁, . . . , i_(d), (3) the chairman terminal calculates verification information v=A ^(k) B{circumflex over ( )}{(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq), v _(i1) =A _(i1) ^(k) B _(i1){circumflex over ( )}{(c×k) modq} modp, . . . ,  v _(id) =A _(i1) ^(k) B _(id){circumflex over ( )}{(c×k) modq} modp  and then broadcasts them together with the exclusive information C2 _(i1), . . . , C2 _(id) and the particular terminal numbers i₁, . . . , i_(d) to all terminals, (4) the chairman terminal calculates a common key K=Γ ^(k) modp (5) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate λ(j, Λ), λ(i₁, Λ), . . . , λ(i_(d), Λ) where Λ={j, i₁, . . . , i_(d)}, and calculate a verification equation {C 1 ₁{circumflex over ( )}((α1 _(j)+β1 _(j) ×c)λ(j, Λ) modq)}{C 1 ₂{circumflex over ( )}((α2 _(j)+β2 _(j) ×c)λ (j, Λ) modq)}×v _(i1){circumflex over ( )}{λ(i ₁, Λ) modq}× . . . ×v _(id){circumflex over ( )}{λ(i _(d), Λ) modq} modp=v(c=hash (C 1 ₁ , C 1 ₂) modq)  by using the public keys A, B of the system and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), and then stop key sharing unless the verification equation is satisfied and, if the verification equation is satisfied, (6) the respective terminals j calculate C 1 ₁{circumflex over ( )}{γ_(j)×(λ(j, Λ) modq)}×C 2 _(i1){circumflex over ( )}(λ(i ₁, Λ) modq)× . . . × C 2 _(id){circumflex over ( )}(λ(i _(d), Λ) modq)×C 2 _(b1){circumflex over ( )}{(λ(b ₁, Λ) modq)}× . . . × C 2 _(bv){circumflex over ( )}(λ(b _(v), Λ) modq) modp  by using λ(j, Λ), (λ(i₁, Λ), . . . , λ(i_(D), Λ), λ(b₁, Λ), . . . , λ(b_(v), Λ), the preparatory information C1 ₁, the exclusive information C2 _(i1), . . . , C2 _(iD), C2 _(b1), . . . , C2 _(bv), and the own secret information γ_(j) to thus obtain the common key K.
 32. An exclusive key sharing method according to claims 25 or 26, wherein the chairman terminal can use public information formulated based on θ sets of secret information, which are derived by dividing the secret keys α1, α2, β1, β2, γ to the θ particular terminal numbers d₁, . . . , d₀ (θ is any integer) respectively, and the terminal holds θ pieces of secret information, which correspond to own terminal number, out of respective sets, and when key sharing is carried out to exclude the particular terminals, the chairman terminal and the respective terminals j select a particular terminal number d_(w) (1≦w≦θ), which is equal to the actual particular terminal number D, from the particular terminals d₁, . . . , d_(θ), and then the chairman terminal broadcasts the verification information, the exclusive information, the particular terminal number, and the own terminal number, by using a set of public information corresponding to the selected particular terminal number d_(w) to obtain a common key K which is shared with the terminals, and the terminals j confirm the verification equation and obtain the common key K which is shared with the chairman terminal by using the secret information corresponding to the d_(w).
 33. An exclusive key sharing method for a communication system which consists of a base station and N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication, according to claims 25 or 30, wherein secret keys are α1, α2, β1, β2, γ, a prime number which is larger than α1, α2, β1, β2, γ and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g1, g2, and a particular terminal number is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i) in secret to satisfy α1=Σλ(i, Λ)×α1 _(i)(sum of iεΛ is calculated) (where α1 _(i)=α1+f₁×i¹+ . . . +f_(d)×i^(d) modq) α2=Σλ(i, Λ)×α2 _(i)(sum of iεΛ is calculated) (where α2 _(i)=α2+f₁×i¹+ . . . +f_(d)×i^(d) modq) β1=Σλ(i, Λ)×β1 _(i)(sum of iεΛ is calculated) (where β1 _(i)=β1+f₁×i¹+ . . . +f_(d)×i^(d) modq) β2=Σλ(i, Λ)×β2 _(i)(sum of iεΛ is calculated) (where β2 _(i)=β2+f₁×i¹+ . . . +f_(d)×i^(d) modq) γ=Σλ(i, Λ)×γ_(i)(sum of iεΛ is calculated) (where γ_(i)=γ+f₁×i¹+ . . . +f_(d)×i^(d) modq) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use public keys of the system A=g ₁ ^(α1) g ₂ ^(α2) modp, B=g ₁ ^(β1) g ₂ ^(β2) modp, Γ=g ₁ ^(γ) modp,  the prime number p, the measure q, the elements g1, g2, and a Hash function hash ( ), and the base station holds secret information α1 ₁, . . . , α1 _(N), α2 ₁, . . . , α2 _(N), β1 ₁, . . . , β1 _(N), β2 ₁, . . . , β2 _(N), γ₁, . . . , γ_(N), and (1) the base station generates arbitrarily a non-zero element k of GF(q), and calculates preparatory information C 1 ₁ =g ₁ ^(k) modp, C1 ₂=g₂ ^(k) modp (2) the base station calculates exclusive information C 2 _(i1) =g ₁{circumflex over ( )}{γ_(i1) ×k modq} modp, . . . , C 2 _(id) =g ₁{circumflex over ( )}{γ_(id) ×k modq} modp  based on the secret information γ_(i1), . . . , γ_(id) of the d particular terminals i₁, . . . , i_(d), (3) the base station calculates verification information v=A ^(k) B{circumflex over ( )}{(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq), v _(i1)=(g ₁ ^(α1i1) g ₂ ^(α2i1))^(k)(g ₁ ^(β1i1) g ₂β^(2i1)){circumflex over ( )}{(c×k) modq} modp, . . . , v _(id)=(g ₁ ^(α1id) g ₂ ^(α2id))^(k)(g ₁ ^(β1id) g ₂β^(2id)){circumflex over ( )}{(c×k) modq} modp, . . . ,  and then broadcasts them together with the exclusive information C2 _(i1), . . . , C2 _(id), and the particular terminal numbers i₁, . . . , i_(d) to all terminals, (4) the base station calculates a common key K=Γ ^(k) modp, (5) the respective terminals j (j≠i₁, . . . i_(d)) calculate λ(j, Λ), λ(i, Λ), . . . , λ(i_(d), Λ) where Λ={j, i₁, . . . , i_(d)}, and then calculate a verification equation {C 1 ₁{circumflex over ( )}((α1 _(j)+β1 _(j) ×c)λ (j, Λ) modq)}{C 1 ₂{circumflex over ( )}((α2 _(j)+β2 _(j) ×c)λ(j, Λ) modq)}×v _(i1){circumflex over ( )}{λ(i ₁, Λ) modq}× . . . ×v _(id){circumflex over ( )}{λ(i _(d), Λ) modq} modp=v(c=hash (C 1 ₁ , C 1 ₂) modq)  by using the public keys A, B of the system and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), and then stop key sharing unless the verification equation is satisfied and, if the verification equation is satisfied, (6) the respective terminals j calculate C 1 ₁{circumflex over ( )}{γ_(j)×(λ(j, Λ) mod q)}×C 2 _(i1){circumflex over ( )}(λ(i ₁, Λ) modq)× . . . ×C 2 _(id){circumflex over ( )}(λ(i _(d), Λ) modq) modp  by using λ(j, Λ),(λ(i₁, Λ), . . . , λ(i_(d), Λ), the preparatory information C1 ₁, the exclusive information C2 _(i1), . . . , C2 _(id), and the own secret information γ_(j) to thus obtain the common key K.
 34. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, according to claims 25 or 30, wherein secret keys are α1, α2, β1, β2, γ, a prime number which is larger than α1, α2, β1, β2, γ and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g1, g2, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i) in secret, and can use public keys of the system A=g ₁ ^(α1) g ₂ ^(α2) modp, B=g ₁ ^(β1) g ₂ ^(β2) modp, Γ=g ₁ ^(γ) modp,  public information A ₁ =g ₁ ^(α11) g ₂ ^(α21) modp, . . . , A _(N) =g ₁ ^(α1N) g ₂ ^(α2N) modp, B ₁ =g ₁ ^(β11) g ₂ ^(β21) modp, . . . , B _(N) =g ₁ ^(β1N) g ₂ ^(β2N) modp, Γ₁ =g ₁ ^(γ1) modp, . . . , Γ _(N) =g ₁ ^(γN) modp  which are calculated by the secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i), the prime number p, the measure q, the elements g1, g2, and a Hash function hash ( ), and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates preparatory information C 1 ₁ =g ₁ ^(k) modp, C 1 ₂ =g ₂ ^(k) modp (2) the chairman terminal calculates exclusive information  C 2 _(i1)=Γ_(i1) ^(k) modp, . . . , C 2 _(id)=Γ_(id) ^(k) modp  based on the public information Γ_(i1), . . . , Γ_(id) of the d particular terminals i₁, . . . , i_(d), (3) the chairman terminal calculates a common key K=Γ ^(k) modp, (4) the chairman terminal generates any group key M and formulates a ciphertext C=M×K modp  by using the common key K, (5) the chairman terminal calculates verification information v=A ^(k) B{circumflex over ( )}{c×k modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq), v _(i1) =A _(i1) ^(k) B _(i1) {circumflex over ( )}{c×k modq} modp, . . . , v _(id) =A _(i1) ^(k) B _(id) {circumflex over ( )}{c×k modq} modp  and then broadcasts the ciphertext C and the verification information v, v_(i1), . . . , v_(id) together with the exclusive information C2 _(i1), . . . , C2 _(id) and the particular terminal numbers i₁, . . . , i_(d) to all terminals, (6) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate λ(j, Λ), λ(i₁, Λ), . . . , λ(i_(d), Λ) where Λ={j, i₁, . . . , i_(d)}, and then calculate a verification equation {C 1 ₁{circumflex over ( )}((α1 _(j)+β1 _(j) ×c)λ (j, Λ) modq)}{C 1 ₂{circumflex over ( )}((α2 _(j)+β2 _(j) ×c)λ(j, Λ) modq)}×v _(i1){circumflex over ( )}{λ(i ₁, Λ) modq}× . . . ×v _(id){circumflex over ( )}{λ(i _(d), Λ) modq} modp=v(c=hash (C, C 1 ₁ , C 1 ₂) modq)  by using the public keys A, B of the system and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), and then stop key sharing unless the verification equation is satisfied and, if the verification equation is satisfied, (7) the respective terminals j calculate C 1 ₁{circumflex over ( )}{γ_(j)×(λ(j, Λ) modq)}×C 2 _(i1){circumflex over ( )}(λ(i ₁, Λ) modq)× . . . ×C 2 _(id){circumflex over ( )}(λ(i _(d), Λ) modq) modp  by using λ(j, Λ),(λ(i_(d), Λ), . . . , λ(i_(d), Λ), the preparatory information C1 ₁, C1 ₂, the exclusive information C2 _(i1), . . . , C2 _(id), and the own secret information γ_(j) to thus obtain the common key K, (8) the respective terminals j calculate the group key M=C/K modp by the common key K and the ciphertext C.
 35. An exclusive key sharing method according to claims 25 or 30, wherein the base station executes division of the secret key S or α1, α2, β1, β2, γ1, γ2, calculation and publication of the public key y or A, B, Γ, the public information y₁, y₂, . . . , y_(N) or A₁, . . . , A_(N), B₁, . . . , B_(N), Γ₁, . . . , Γ_(N), and allocation of the secret information S_(i) or α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i) corresponding to the terminal i.
 36. An exclusive key sharing method according to claim 9, wherein a third party which is different from the base station executes division of the secret key S or α1, α2, β1, β2, γ1, γ2, calculation and publication of the public key y or A, B, Γ, the public information y₁, y₂, y_(N) or A₁, . . . , A_(N), B₁, . . . , B_(N), Γ₁, . . . , Γ_(N), and allocation of the secret information S_(i) or α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i) corresponding to the terminal i.
 37. An exclusive key sharing method according to claims 25 or 30, wherein new terminal numbers I (I>N) are set to terminals which newly enter into the communication system which can execute the broadcast communication, and then secret information S_(i) or α1 ₁=α1 +f ₁ ×I ¹ + . . . +f _(d) ×I ^(d) modq α2 ₁=α2 +f ₁ ×I ¹ + . . . +f _(d) ×I ^(d) modq β1 ₁=β1 +f ₁ ×I ¹ + . . . +f _(d) ×I ^(d) modq β2 ₁=β2 +f ₁ ×I ¹ + . . . +f _(d) ×I ^(d) modq γ1 ₁=γ1 +f ₁ ×I ¹ + . . . +f _(d) ×I ^(d) modq γ2 ₁=γ2 +f ₁ ×I ¹ + . . . +f _(d) ×I ^(d) modq which are obtained by calculating S ₁ =S+f ₁ ×I ¹ + . . . +f _(d) ×I ^(d) modq are held in secret in new terminals.
 38. An exclusive key sharing method according to claims 25 or 30, wherein the terminal i saves in secret a power residue of Ci or C1 ₁, C1 ₂(=C1 ^(Si) modp or C1 ₁ ^(α1i)C1 ₂ ^(α2i) modp, C1 ₁ ^(β1i)C1 ₂ ^(β2i) modp, C1 ₁ ^(γ1i)C1 ₂ ^(γ2i) modp) which has p in place of the secret information S_(i) or α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i) as the modulus and S_(i) or α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i) as the exponent.
 39. An exclusive key sharing method according to claims 1 or 6, wherein the chairman terminal or the base station calculates λ(j, Λ) for all Λ's including the particular terminals, then calculates a power residue value of the exclusive information C2 _(i) C 2 _(i){circumflex over ( )}(λ(i, Λ) modq) modp  which has λ(i, Λ) calculated to the modulus q as the exponent and p as the modulus, then broadcasts it in sharing the key, and all terminals j except the particular terminal obtain the common key K by using the power residue value in answer to the Λ's including the j.
 40. An exclusive key sharing method according to claims 25 or 30, wherein all terminals j except the base station and the particular terminal generate a new common key K2 based on the shared common key K and the common key K1 shared at a time of previous key sharing.
 41. An exclusive key sharing method according to claim 30, wherein a digital signature of the base station is added to data which are distributed from the base station by a digital signature means provided previously to the base station and the terminals.
 42. An exclusive key sharing method according to claims 25 or 30, wherein a number of secret information held by the terminals is increased and decreased in response to authority of the terminals.
 43. An exclusive key sharing method according to claims 25 or 30, wherein the chairman terminal and the base station select only own terminal as the particular terminal, and broadcast information necessary for the key sharing by using an encrypted communication path using the common key K.
 44. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, according to claim 25, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) S _(i) =S+f ₁ ×i ¹ + . . . +f _(d) ×i ^(d) modq  (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use a public key of the system managed by a system manager y=g ^(s) modp,  public information y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp,  the prime number p, the measure q, and the elements g, and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates exclusive information C 2 _(i1) =y _(i1) ^(k) modp, . . . , C 2 _(id) =y _(id) ^(k) modp  based on the public information y_(i1), . . . , y_(id) of the d particular terminals i₁, . . . , i_(d), (2) the chairman terminal calculates a signature Z=C 2 _(i1) × . . . ×C 2 _(id)×(−S _(φ))+k modq  by using own secret information S_(φ), and broadcasts the signature Z together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d), and own terminal number φ to all terminals, (3) the chairman terminal calculates a common key K=y ^(k) modp, (4) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate C 1=g ^(z) ×y _(φ){circumflex over ( )}(C 2 _(i1) × . . . ×C 2 _(id) modq) modp (if a signer is surely the chairman terminal φ and also the signature Z, the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d), and the terminal number φ of the chairman terminal are not tampered, C1=g^(k) modp is calculated) by using the public information y_(φ) of the chairman terminal, (5) the respective terminals j calculate λ(j, Λ) and λ(i₁, Λ), . . . , λ(i_(d), Λ) where Λ={j, i₁, . . . , i_(d)} and calculate C1{circumflex over ( )}(S_(j)×λ(j, Λ) modq)×C2 _(i1){circumflex over ( )}(λ(i₁, Λ) modq)× . . . ×C2 _(id){circumflex over ( )}(λ(i_(d), Λ) modq) modp by using the C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j) to thus obtain the common key K, and (i) the system manager generates arbitrarily a non-zero elementε of GF(q), and broadcasts theε to all terminals, (ii) the system manager calculates a new element g′=g{circumflex over ( )}{(1/ε) modq} modp,  and replaces the managed element g with it, (iii) the respective terminals i calculate new secret information S _(i)′=S_(i)×ε modq  (at this time, (g′)^(Si′) modp=(g)^(Si) modp is satisfied).
 45. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, according to claim 30, wherein secret keys are α1, α2, β1, β2, γ1, γ2, a prime number which is larger than α1, α2, β1, β2, γ1, γ2, and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g1, g2, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i) in secret to satisfy α1=Σλ(i, Λ)×α1 _(i) (sum of iεΛ is calculated) (where α1 _(i)=α1+f₁×i¹+ . . . +f_(d)×i^(d) modq) α2=Σλ(i, Λ)×α2 _(i) (sum of iεΛ is calculated) (where α2 _(i)=α2+f₁×i¹+ . . . +f_(d)×i^(d) modq) β1=Σλ(i, Λ)×β1 _(i) (sum of iεΛ is calculated) (where β1 _(i)=β1+f₁×i¹+ . . . +f_(d)×i^(d) modq) β2=Σλ(i, Λ)×β2 _(i) (sum of iεΛ is calculated) (where β2 _(i)=β2+f₁×i¹+ . . . +f_(d)×i^(d) modq) γ1=Σλ(i, Λ)×γ1 _(i) (sum of iεΛ is calculated) (where γ1 _(i)=γ1+f₁×i¹+ . . . +f_(d)×i^(d) modq) γ2=Σλ(i, Λ)×γ2 _(i) (sum of iεΛ is calculated) (where γ2 _(i)=γ2+f₁×i¹+ . . . +f_(d)×i^(d) modq) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0 and Λ is a set of any (d+1) terminals out of the N terminals), and can use public keys of the system A=g ₁ ^(α1) g ₂ ^(α2) modp, B=g ₁ ^(β1) g ₂ ^(β2) modp, Γ=g ₁ ^(γ1) g ₂ ^(γ2) modp,  which are managed by a system manager, public information A ₁ =g ₁ ^(α11) g ₂ ^(α21) modp, . . . , A _(N) =g ₁ ^(α1N) g ₂ ^(α2N) modp B ₁ =g ₁ ^(β11) g ₂ ^(β21) modp, . . . , B _(N) =g ₁ ^(β1N) g ₂ ^(β2N) modp Γ₁ =g ₁ ^(γ11) g ₂ ^(γ21) modp, . . . , Γ _(N) =g ₁ ^(γ1N) g ₂ ^(γ2N) modp  which are calculated by the secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ1 _(i), γ2 _(i), the prime number p, the measure q, the elements g1, g2, and a Hash function hash ( ), and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates preparatory information C 1 ₁ =g ₁ ^(k) modp, C 1 ₂ =g ₂ ^(k) modp, (2) the chairman terminal calculates exclusive information C 2 _(i1)=Γ_(i1) ^(k) modp, . . . , C 2 _(id)=Γ_(id) ^(k) modp  based on the public information Γ_(i1), . . . Γ_(id) of the d particular terminals i₁, . . . , i_(d), (3) the chairman terminal calculates verification information v=A ^(k) B{circumflex over ( )}{(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq), v _(i1) =A _(i1) ^(k) B _(i1){circumflex over ( )}{(c×k) modq} modp, . . . , v _(id) =A _(i1) ^(k) B _(id){circumflex over ( )}{(c×k) modq} modp  and then broadcasts them together with the exclusive information C2 _(i1), . . . , C2 _(id) and the particular terminal numbers i₁, . . . , i_(d) to all terminals, (4) the chairman terminal calculates a common key K=Γ ^(k) modp (5) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate λ(j, Λ), λ(i₁, Λ), . . . , λ(i_(d), Λ) where Λ={j, i₁, . . . , i_(d)}, and calculate a verification equation {C 1 ₁ ^(α1j) C 1 ₂ ^(α2j)(C 1 ₁ ^(β1j) C 1 ₂ ^(β2j))^(C)){circumflex over ( )}{λ(j, Λ) modq}× v _(i1){circumflex over ( )}{λ(i ₁, Λ) modq}× . . . ×v _(id){circumflex over ( )}{λ(i _(d), Λ) modq} modp=v (c=hash (C 1 ₁ , C 1 ₂) modq)  by using the public keys A, B of the system and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), and then stop key sharing unless the verification equation is satisfied and, if the verification equation is satisfied, (6) the respective terminals j calculate (C 1 ₁ ^(γ1j) C 1 ₂ ^(γ2j)){circumflex over ( )}{(j, Λ) modq}× C 2 _(i1){circumflex over ( )}{λ(i ₁, Λ) modq}× . . . ×C 2 _(id){circumflex over ( )}(λ(i _(d), Λ) modq) modp  by using λ(j, Λ), (λ(i₁, Λ), . . . , λ(i_(d), Λ) the preparatory information C1 ₁, C1 ₂, the exclusive information C2 _(i1), . . . , C2 _(id), and the own secret information γ1 _(j), γ2 _(j), to thus obtain the common key K which is shared with the chairman terminal, and (i) the system manager generates arbitrarily a non-zero elementε of GF(q), and broadcasts theε to all terminals, (ii) the system manager calculates new elements  g ₁ ′=g ₁{circumflex over ( )}{(1/ε) modq} modp, g ₂ ′=g ₂{circumflex over ( )}{(1/ε) modq} modp and replaces the managed element g with them, (iii) the respective terminals i calculate new secret information α1 _(i)′=α1 _(i)×ε modq α2 _(i)′=α2 _(i)×ε modq β1 _(i)′=β1 _(i)×ε modq β2 _(i)′=β2 _(i)×ε modq γ1 _(i)′=γ1 _(i)×ε modq γ2 _(i)′=γ2 _(i)×ε modq (at this time, (g′)^(α1i′)modp=(g)^(α1i) modp (g′)^(α2i′)modp=(g)^(α2i) modp (g′)^(β1i′)modp=(g)^(β1i) modp (g′)^(β2i′)modp=(g)^(β2i) modp (g′)^(γ1i′)modp=(g)^(γ1i) modp and (g′)^(γ2i′)modp=(g)^(γ2i) modp are satisfied).
 46. An exclusive key sharing method according to claims 44 or 45, wherein the chairman terminal or the base station broadcasts an encryptedε which is encrypted by using the common key K to all terminals.
 47. An exclusive key sharing method according to claims 25 or 30, wherein only the chairman terminal can use the public information of respective terminals.
 48. An exclusive key sharing method according to claims 25 or 30, wherein respective terminals hold all public information other than own public information.
 49. An exclusive key sharing method for a communication system which consists of a base station and N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, and a number of terminals which can be specified by the base station (referred to as a “particular terminal number” hereinafter) is 1, respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)  (where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and the base station holds (S, p, g, S₁, . . . , S_(N)), the base station calculates preparatory information C ₁ =g ^(k) modp  where an element of GF(p) is g and a non-zero element of GF(q) is k, the base station calculates exclusive information C ₂ =g{circumflex over ( )}(k×S _(a) modq) modp,  based on the secret information S_(a) of the particular terminal a, and broadcasts the exclusive information together with the particular terminal number a and the preparatory information C₁ to all terminals, and the base station calculates a common key K=g{circumflex over ( )}(k×S modq) modp  which is shared with all terminals j (j≠a) except the particular terminal a, the respective terminals j (j≠a) calculate a product C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C ₂{circumflex over ( )}(λ(a, Λ) modq) modp  of a power residue value of C₁ C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq) modp  which uses a product of Si and λ(j, Λ) to the modulus q as an exponent and a power residue value of C₂ C ₂{circumflex over ( )}(λ(a, Λ) modq) modp  which uses λ(a, Λ) calculated to the modulus p as the exponent by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain the common key K which is shared with the base station, and (i) the base station generates arbitrarily a non-zero element e of GF(q), and broadcasts the e to all terminals, (ii) the base station calculates a new element g′=g ^(1/e modq) modp  and replaces the managed element g with it, (iii) the respective terminals i calculate new secret information S _(i) ′=S _(i) ×e modq  (at this time, (g′)^(Si′) modp=(g)^(Si) modp is satisfied).
 50. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal (to which any terminal can be appointed) is 1, respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)  (where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and can use the prime number p, the measure q, and the elements g, which are managed by a system manager, a public key for all terminals which is managed by the system manager y=g ^(S) modp,  and public information y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp  which are managed by the system manager, and the chairman terminal generates arbitrarily a non-zero element k of GF(q) and calculates preparatory information C ₁ =g ^(k) modp, the chairman terminal calculates exclusive information C ₂ =y _(a) ^(k) modp,  based on the public information y_(a) of the particular terminal a, and broadcasts the exclusive information together with the particular terminal number a and the preparatory information C₁ to all terminals, and the chairman terminal calculates a common key K=y ^(k) modp,  and the respective terminals j (j≠a) calculate λ(j, Λ) and λ(a, Λ) where Λ={j, a} and calculate C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C ₂{circumflex over ( )}(λ(a, Λ) modq) modp  by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain the common key K which is shared with the chairman terminal, and (i) the system manager generates arbitrarily a non-zero element e of GF(q), and broadcasts the e to all terminals, (ii) the system manager calculates a new element g′=g ^(1/e) modq modp  and replaces the managed element g with it, and (iii) the respective terminals i calculate new secret information S _(i) ′=S _(i) ×e modq (at this time, (g′)^(Si′) modp=(g)^(Si) modp is satisfied).
 51. An exclusive key sharing method for a communication system which consists of a base station and N terminals (N is an integer of more than 2) connected to the base station to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, and a number of terminals which can be specified by the base station (referred to as a “particular terminal number” hereinafter) is 1, respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)  (where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and the base station holds (S, p, g, S₁, . . . , S_(N)), the base station calculates preparatory information C ₁ =g ^(k) modp  where an element of GF(p) is g and a non-zero element of GF(q) is k, the base station calculates exclusive information C ₂ =g{circumflex over ( )}(k×S _(a) modq) modp,  based on the secret information S_(a) of the particular terminal a, and broadcasts the exclusive information together with the particular terminal number a and the preparatory information C₁ to all terminals, and the base station calculates a common key K=g{circumflex over ( )}(k×S modq) modp  which is shared with all terminals j (j≠a) except the particular terminal a, and the respective terminals j (j≠a) calculate a product C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C ₂{circumflex over ( )}(λ(a, Λ) modq) modp  of a power residue value of C₁  C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq) modp  which uses a product of Si and λ(j, Λ) to the modulus q as an exponent and a power residue value of C₂ C ₂{circumflex over ( )}(λ(a, Λ) modq) modp  which uses λ(a, Λ) calculated to the modulus p as the exponent by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain the common key K which is shared with the base station, and (i) the base station generates arbitrarily a non-zero element e of GF(q), and broadcasts an encrypted e which is encrypted by using the common key K to all terminals, (ii) the base station calculates a new element g′=g ^(1/e modq) modp  and replaces the element g with it, (iii) the respective terminals j decrypt the encrypted e by using the common key K, and calculate new secret information S _(j) ′=S _(j) ×e modq  (at this time, (g′)^(Sj′) modp=(g)^(Sj) modp is satisfied).
 52. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal (to which any terminal can be appointed) is 1, respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)  (where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and can use a public key for all terminals y=g ^(S) modp  and public information y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp, the chairman terminal generates a non-zero element k of GF(q) and calculates preparatory information C ₁ =g ^(k) modp, the chairman terminal calculates exclusive information C ₂ =y _(a) ^(k) modp  based on the public information y_(a) of the particular terminal a, and broadcasts the exclusive information together with the particular terminal number a and the preparatory information C₁ to all terminals, and the chairman terminal calculates a common key K=y ^(k) modp, the respective terminals j (j≠a) calculate λ(j, Λ) and λ(a, Λ) where Λ={j, a}, and calculate C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C ₂{circumflex over ( )}(λ(a, Λ) modq) modp  by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain the common key K which is shared with the chairman terminal, and (i) the chairman terminal generates arbitrarily a non-zero element e of GF(q), and broadcasts an encrypted e which is encrypted by using the common key K to all terminals, (ii) the chairman terminal calculates a new element g′=g ^(1/e) modq modp  and replaces the element g with it, (iii) the respective terminals j decrypt the encrypted e by using the common key K, and calculate new secret information S _(j) ′=S _(j) ×e modq (at this time, (g′)^(Sj′) modp=(g)^(Sj) modp is satisfied).
 53. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal b is 1, respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)  (where S_(i)=S+f₁×i modq (f1 is a non-zero element of GF(q)), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any two terminals out of the N terminals), and the chairman terminal b can use a public key for all terminals y=g ^(S) modp  and public information y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp, the chairman terminal b generates a non-zero element k of GF(q) and calculates preparatory information C 1 ₁ =g ^(k) modp, the chairman terminal b calculates exclusive information C ₂ =y _(a) ^(k) modp  based on the public information y_(a) of the particular terminal a, and broadcasts the exclusive information together with the particular terminal number a and the preparatory information C₁ to all terminals, and the chairman terminal b calculates a common key K=y ^(k) modp, the respective terminals j (j≠a, b) calculate λ(j, Λ) and λ(a, Λ) where Λ={j, a}, and calculate C ₁{circumflex over ( )}(S _(j)×λ(j, Λ) modq)×C ₂{circumflex over ( )}(λ(a, Λ) modq) modp  by using the preparatory information C₁, the exclusive information C₂, and own secret information S_(j) to thus obtain the common key K.
 54. An exclusive key sharing method according to claim 5, wherein all terminals except the chairman terminal b can use public information of the chairman terminal b y _(b) =g ^(Sb) modp, the chairman terminal b adds a digital signature to the particular terminal number a, the preparatory information C₁, the exclusive information C₂, which are delivered to all terminals, by using the secret information Sb of the chairman terminal b, and the respective terminals j verify the signature by using the public information y_(b) of the chairman terminal.
 55. An exclusive key sharing method according to claim 52 wherein the base station and the chairman terminal delivers the element e to the particular terminal number a, and the particular terminal number a calculates new secret information S _(a) ′=S _(a) ×e modq (at this time, (g′){circumflex over ( )}S_(a)′ modp=(g){circumflex over ( )}S_(a) modp is satisfied).
 56. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)  (where S_(i)=S+f₁×i+ . . . +f_(d)×i^(d) modq (f₁, . . . , f_(d) are d elements of GF(q) where f_(d)≠0), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any (d+1) terminals out of the N terminals), and the respective terminals i and the chairman terminal φ can use a public key of the system y=g ^(S) modp  which is a power residue value of g having the secret key S as an exponent and p as a modulus, public information y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp  which are power residue values of g having the secret information S₁, S₂, . . . , S_(N) allocated to terminals as exponents respectively and p as the modulus, and the p, q, and g, (1) the chairman terminal calculates preparatory information C 1=g ^(k) modp (k is a non-zero element of GF(q)), (2) the chairman terminal calculates exclusive information C 2 _(i1) =y _(i1){circumflex over ( )}(k×λ(i ₁, α) modq) modp, . . . , C 2 _(id) =y _(id){circumflex over ( )}(k×λ(i _(d), α) modq) modp  based on a set a of d particular terminals i₁, . . . , i_(d), λ(i₁, α), . . . , λ(i_(d), α), and public information y_(i1), . . . , y_(id), and broadcasts the exclusive information C2 _(i1), . . . , C2 _(id) together with the preparatory information C1 and the particular terminal number i₁, . . . , i_(d) to all terminals, and (3) the chairman terminal calculates a common key K=y ^(k) modp  which is shared with all terminals j (j≠i₁, . . . , i_(d)) except the particular terminals i₁, . . . , i_(d), (4) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}) and T _(j)={Π(j−L)}/j (product of LεΛ _(j) −{j} is calculated)  where Λ_(j)={j, i₁, . . . , i_(d)}, calculate cession keys $K_{j} = {{{C1}\hat{}\left( {S_{j} \times {\lambda \left( {j,\Lambda_{j}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \times {{C2}_{il}\hat{}\left( {{\lambda \left( {i_{l},\left\{ {j,i_{l}} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \times \ldots \times {{C2}_{id}\hat{}\left( {{\lambda \left( {i_{d},\left\{ {j,i_{d}} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right)}\quad {mod}\quad p}$

 by using the preparatory information C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j), and calculates a power residue value of K_(j) K _(j){circumflex over ( )}(1/T _(j) modq) modp  which has 1/T_(j) as an exponent and p as a modulus to thus obtain the common key K (=g^(k×S) modp).
 57. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)  (where S_(i)=S+f₁×i+ . . . +f_(d)×i^(d) modq (f₁, . . . , f_(d) are d elements of GF(q) where f_(d)≠0), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any (d+1) terminals out of the N terminals), and the respective terminals i and the chairman terminal can use a public key of the system  y=g ^(S) modp  which is a power residue value of g having the secret key S as an exponent and p as a modulus, public information y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp  which are power residue values of g having the secret information S₁, S₂, . . . , S_(N) allocated to terminals as exponents respectively and p as the modulus, and the p, q, and g, (1) the chairman terminal calculates preparatory information C 1=g ^(k) modp (k is a non-zero element of GF(q)), (2) the chairman terminal calculates exclusive information C 2 _(i1) =y _(i1) ^(k) modp, . . . , C 2 _(id) =y _(id) ^(k) modp  based on public information y_(i1), . . . , y_(id) of the d particular terminals i₁, . . . , i_(d), and broadcasts the exclusive information C2 _(i1), . . . , C2 _(id) together with the preparatory information C1 and the particular terminal number i₁, . . . , i_(d) to all terminals, and (3) the chairman terminal calculates a common key K=y ^(k) modp  which is shared with all terminals j (j≠i₁, . . . , i_(d)) except the particular terminals i₁, . . . , i_(d), (4) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate inverse elements F _(i1) =C 2 _(i1) ⁽⁻¹) modp, . . . , F _(id) =C2 _(id) ⁽⁻¹⁾ modp  of the exclusive information C2 _(i1), . . . , C2 _(id), calculate λ(j, Λ_(j)), λ(i₁, Λ_(j)), . . . , λ(i_(d), Λ_(j)) where Λ_(j)={j, i₁, . . . , i_(d)}, calculate cession keys $\begin{matrix} {K_{j} = {{{C1}\hat{}\left( {S_{j} \times {\lambda \left( {j,\Lambda_{j}} \right)} \times t_{j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{i1}\hat{}\left( {{\lambda \left( {i_{1},\Lambda_{j}} \right)} \times t_{j}\quad {mod}\quad q} \right)} \times \ldots \times}} \\ {{{{C2}_{id}\hat{}\left( {{\lambda \left( {i_{d},\Lambda_{j}} \right)} \times t_{j}\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \end{matrix}$

 by using a positive square root t_(j) of an absolute value of a product of these denominators, the preparatory information C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j), replace λ(i₁, Λ_(j)) with |λ(i₁, Λ_(j))| and replace C2 _(i1) with F_(i1) if λ(i₁, Λ_(j))<0 while replace λ(i_(d), Λ_(j)) with |λ(i_(d), Λ_(j))| and replace C2 _(id) with F_(id) if λ(i_(d), Λ_(j))<0, and calculates a power residue value of K_(j) K _(j){circumflex over ( )}(1/t _(j) modq) modp  which has 1/t_(j) as an exponent and p as a modulus to thus obtain the common key K (=g^(k×S) modp).
 58. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated)  (where S_(i)=S+f₁×i+ . . . +f_(d)×i^(d) modq (f₁, . . . , f_(d) are d elements of GF(q) where f_(d)≠0), λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated), and Λ is a set of any (d+1) terminals out of the N terminals), and the respective terminals i and the chairman terminal can use a public key of the system y=g ^(S) modp  which is a power residue value of g having the secret key S as an exponent and p as a modulus, public information y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp  which are power residue values of g having the secret information S₁, S₂, . . . , S_(N) allocated to terminals as exponents respectively and p as the modulus, and the p, q, and g, (1) the chairman terminal calculates preparatory information C 1=g ^(k) modp (k is a non-zero element of GF(q)), (2) the chairman terminal calculates exclusive information C 2 _(i1) =y _(i1){circumflex over ( )}(k×λ(i ₁, α) modq) modp, . . . , C 2 _(id) =y _(id){circumflex over ( )}(k×λ(i _(d), α) modq) modp  based on a set α of d particular terminals i₁, . . . , i_(d), λ(i₁, α), . . . , λ(i_(d), α), and public information y_(i1), . . . y_(id), and broadcasts the exclusive information C2 _(i1), . . . , C2 _(id) together with the preparatory information C1 and the particular terminal number i₁, . . . , i_(d) to all terminals, and (3) the chairman terminal calculates a common key K=y ^(k) modp  which is shared with all terminals j (j≠i₁, . . . , i_(d)) except the particular terminals i₁, . . . , i_(d), (4) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate inverse elements F _(i1) =C 2 _(i1) ⁽⁻¹) modp, . . . , F _(id) =C 2 _(id) ⁽⁻¹⁾ modp  of the exclusive information C2 _(i1), . . . , C2 _(id), calculate λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}) and T _(j)={Π(j−L)}/j (product of LεΛ _(j) −{j} is calculated)  where Λ_(j)={j, i₁, . . . , i_(d)}, calculate cession keys K _(j) =C 1{circumflex over ( )}(S _(j)×λ(j, Λ _(j))×T _(j) modq) ×C 2 _(i1){circumflex over ( )}(λ(i ₁ , {j,i ₁})×T _(j) modq)×. . . ×C 2 _(id){circumflex over ( )}(λ(i _(d) , {j,i _(d)})×T _(j) modq)modp  by using the preparatory information C₁, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j), replace λ(i₁, {j, i₁})×T_(j) with |λ(i₁, {j, i₁})×T_(j)| and replace C2 _(i1) with F_(i1) if λ(i₁, {j, i₁})×T_(j)<0 while replace λ(i_(d), {j, i_(d)})×T_(j)| with |λ(i_(d), {j, i_(d)})×T_(j)| and replace C2 _(id) with F_(id) if λ(i_(d), {j, i_(d)})×T_(j))<0, and calculates a power residue value of K_(j) K _(j){circumflex over ( )}(1/T _(j) modq) modp  which has 1/T_(j) as an exponent and p as a modulus to thus obtain the common key K (=g^(k×S) modp).
 59. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) S _(i) =S+f ₁ ×i+ . . . +f _(d) ×i ^(d) modq  (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use a public key of the system y=g ^(S) modp,  public information y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp,  a Hash function hash ( ), and the prime number p, the measure q, and the element g, (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates exclusive information C 2 _(i1) =y _(i1){circumflex over ( )}(k×λ(i ₁, α) modq) modp, . . . , C 2 _(id) =y _(id){circumflex over ( )}(k×λ(i _(d), α) modq) modp  based on a set α of d particular terminals i₁, . . . , i_(d), λ(i₁, α), . . . , λ(i_(d), α), and public information y_(i1), . . . , y_(id), and (2) the chairman terminal calculates a hash value H=hash(C 2 _(i1) , . . . , C 2 _(id))  which is obtained by compressing the exclusive information C2 _(i1), . . . , C2 _(id) by using the Hash function hash ( ), (3) the chairman terminal calculates a signature Z=H×(−S _(φ))+k modq  by using own secret information S_(φ), and broadcasts the signature together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal number i₁, . . . , i_(d), and own terminal number φ to all terminals, (4) the chairman terminal calculates a common key K=y ^(k) modp, (5) the respective terminals j (j≠i₁, . . . , i_(id), φ) calculate a hash value H′ which is obtained by compressing the exclusive information C2 _(i1), . . . , C2 _(id) by using the Hash function hash ( ), (6) the respective terminals j calculate C 1=g ^(z) ×y _(φ) ^(H′) modp (if a signer is surely the chairman terminal φ and also the signature Z, the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d), and the terminal number φ of the chairman terminal are not tampered, C1=g^(k) modp and H′=H are calculated) by using public information y_(φ) of the chairman terminal, (7) the respective terminals j calculate λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}) and T _(j)={Π(j−L)}/j (product of LεΛ _(j) −{j} is calculated)  where Λ_(j)={j, i₁, . . . , i_(d)} calculate cession keys $\begin{matrix} {K_{j} = {{{C1}\hat{}\left( {S_{j} \times {\lambda \left( {j,\Lambda_{j}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \times}} \\ {{{{C2}_{i1}\hat{}\left( {{\lambda \left( {i_{1},\left\{ {j,i_{1}} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \times \ldots \times}} \\ {{{{C2}_{id}\hat{}\left( {{\lambda \left( {i_{d},\left\{ {j,i_{d}} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right)}\quad {mod}\quad p}} \end{matrix}$

 by using the preparatory information C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j), and calculates a power residue value of K_(j) K _(j){circumflex over ( )}(1/T _(j) modq) modp  which has 1/T_(j) as an exponent and p as a modulus to thus obtain the common key K (=g^(k×S) modp).
 60. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) S _(i) =S+f ₁ ×i+ . . . +f _(d) ×i ^(d) modq  (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use a public key of the system y=g ^(S) modp,  public information y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp, a Hash function hash ( ), and the prime number p, the measure q, and the element g, (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates exclusive information C 2 _(i1) =y _(i1) ^(k) modp, . . . , C 2 _(id) =y _(id) ^(k) modp  based on public information y_(i1), . . . , y_(id) of the d particular terminals i₁, . . . , i_(d), and (2) the chairman terminal calculates a hash value H=hash(C 2 _(i1) , . . . , C 2 _(id))  which is obtained by compressing the exclusive information C2 _(i1), . . . , C2 _(id) by using the Hash function hash ( ), (3) the chairman terminal calculates a signature Z=H×(−S _(φ))+k modq  by using own secret information S_(φ), and broadcasts the signature Z together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal number i₁, . . . , i_(d), and own terminal number φ to all terminals, (4) the chairman terminal calculates a common key K=y ^(k) modp, (5) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate a hash value H′ which is obtained by compressing the exclusive information C2 _(i1), . . . , C2 _(id) by using the Hash function hash ( ), (6) the respective terminals j calculate C 1=g ^(z) ×y _(φ) ^(H′) modp (if a signer is surely the chairman terminal φ and also the signature Z, the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d), and the terminal number φ of the chairman terminal are not tampered, C1=g^(k) modp and H′=H are calculated) by using public information y_(φ) of the chairman terminal, (7) the respective terminals j calculate inverse elements F _(i1) =C 2 _(i1) ⁽⁻¹) modp, . . . , F _(id) =C 2 _(id) ⁽⁻¹⁾ modp  of the exclusive information C2 _(i1), . . . , C2 _(id), calculate λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}) where Λ_(j)={j, i₁, . . . , i_(d)}, calculate cession keys $K_{j} = {{{C1}\hat{}\left( {S_{j} \times {\lambda \left( {j,\Lambda_{j}} \right)} \times t_{j}\quad {mod}\quad q} \right)} \times {{C2}_{il}\hat{}\left( {{\lambda \left( {i_{l},\left\{ {j,i_{l}} \right\}} \right)} \times t_{j}\quad {mod}\quad q} \right)} \times \ldots \times {{C2}_{id}\hat{}\left( {{\lambda \left( {i_{d},\left\{ {j,i_{d}} \right\}} \right)} \times t_{j}\quad {mod}\quad q} \right)}\quad {mod}\quad p}$

 by using a positive square root t_(j) of an absolute value of a product of these denominators, the preparatory information C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j), replace λ(i₁, Λ_(j)) with |λ(i₁, Λ_(j))| and replace C2 _(i1) with F_(i1) if λ(i₁, Λ_(j))<0 while replace λ(i_(d), Λ_(j)) with |λ(i_(d), Λ_(j))| and replace C2 _(id) with F_(id) if λ(i_(d), Λ_(j))<0, and calculates a power residue value of K_(j) K _(j){circumflex over ( )}(1/t _(j) modq) modp  which has 1/t_(j) as an exponent and p as a modulus to thus obtain the common key K (=^(k×S) modp).
 61. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are S, a prime number which is larger than S and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information Si in secret to satisfy S=Σλ(i, Λ)×S _(i) (sum of iεΛ is calculated) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) S _(i) =S+f ₁ ×i+ . . . +f _(d) ×i ^(d) modq (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use a public key of the system y=g ^(S) modp,  public information y ₁ =g ^(S1) modp, y ₂ =g ^(S2) modp, . . . , y _(N) =g ^(SN) modp,  a Hash function hash ( ), and the prime number p, the measure q, and the element g, (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates exclusive information C 2 _(i1) =y _(i1){circumflex over ( )}(k×λ(i ₁, α) modq) modp, . . . , C 2 _(id) =y _(id){circumflex over ( )}(k×λ(i _(d), α) modq) modp  based on a set α of d particular terminals i₁, . . . , i_(d), λ(i₁, α), . . . , λ(i_(d), α), and public information y_(i1), . . . , y_(id), and (2) the chairman terminal calculates a hash value H=hash(C 2 _(i1) , . . . , C 2 _(id))  which is obtained by compressing the exclusive information C2 _(i1), . . . , C2 _(id) by using the Hash function hash ( ), (3) the chairman terminal calculates a signature Z=H×(−S _(φ))+k modq  by using own secret information S_(φ), and broadcasts the signature Z together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal number i₁, . . . , i_(d), and own terminal number φ to all terminals, (4) the chairman terminal calculates a common key K=y ^(k) modp, (5) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate a hash value H′ which is obtained by compressing the exclusive information C2 _(i1), . . . , C2 _(id) by using the Hash function hash ( ), (6) the respective terminals j calculate C 1=g ^(z) ×y _(φ) ^(H′) modp (if a signer is surely the chairman terminal φ and also the signature Z, the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d), and the terminal number φ of the chairman terminal are not tampered, C1=g^(k) modp and H′=H are calculated) by using public information y_(φ) of the chairman terminal, (7) the respective terminals j calculate inverse elements F _(i1) =C 2 _(i1) ⁽⁻¹) modp, . . . , F _(id) =C 2 _(id) ⁽⁻¹⁾ modp  of the exclusive information C2 _(i1), . . . , C2 _(id), calculate λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}) and T _(j)={Π(j−L)}/j (product of LεΛ _(j) −{j} is calculated)  where Λ_(j)={j, i₁, . . . , i_(d)}, calculate cession keys $K_{j} = {{{C1}\hat{}\left( {S_{j} \times {\lambda \left( {j,\Lambda_{j}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \times {{C2}_{il}\hat{}\left( {{\lambda \left( {i_{l},\left\{ {j,i_{l}} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right)} \times \ldots \times {{C2}_{id}\hat{}\left( {{\lambda \left( {i_{d},\left\{ {j,i_{d}} \right\}} \right)} \times T_{j}\quad {mod}\quad q} \right)}\quad {mod}\quad p}$

 by using the preparatory information C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information S_(j), replace λ(i₁, {j, i₁})×T_(j) with |λ(i₁, {j, i₁})×T_(j)| and replace C2 _(i1) with F_(i1) if λ(i₁, {j, i₁})×T_(j)<0 while replace λ(i_(d), {j, i_(d)})×T_(j)) with |λ(i_(d), {j, i_(d)})×T_(j)| and replace C2 _(id) with F_(id) if λ(i_(d), {j, i_(d)})×T_(j))<0, and calculates a power residue value of K_(j) K _(j){circumflex over ( )}(1/T _(j) modq) modp  which has 1/T_(j) as an exponent and p as a modulus to thus obtain the common key K (=g^(k×S) modp).
 62. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are α1, α2, β1, β2, γ, a prime number which is larger than α1, α2, β1, β2, γ and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g1, g2, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i) in secret to satisfy α1=Σλ(i, Λ)×α1 _(i) (sum of iεΛ is calculated) (where α1 _(i)=α1+f₁×i¹+ . . . +f_(d)×i^(d) modq) α2=Σλ(i, Λ)×α2 _(i) (sum of iεΛ is calculated) (where α2 _(i)=α2+f₁×i¹+ . . . +f_(d)×i^(d) modq) β1=Σλ(i, Λ)×β1 _(i) (sum of iεΛ is calculated) (where β1 _(i)=β1+f₁×i¹+ . . . +f_(d)×i^(d) modq) β2=Σλ(i, Λ)×β2 _(i) (sum of iεΛ is calculated) (where β2 _(i)=β2+f₁×i¹+ . . . +f_(d)×i^(d) modq) γ=Σλ(i, Λ)×γ_(i) (sum of iεΛ is calculated) (where γ_(i)=γ+f₁×i¹+ . . . +f_(d)×i^(d) modq) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use public keys of the system A=g ₁ ^(α1) g ₂ ^(α2) modp, B=g ₁ ^(β1) g ₂ ^(β2) modp, Γ=g ₁ ^(γ) modp,  public information A ₁ =g ₁ ^(α11) g ₂ ^(α21) modp, . . . , A _(N) =g ₁ ^(α1N) g ₂ ^(α2N) modp B ₁ =g ₁ ^(β11) g ₂ ^(β21) modp, . . . , B _(N) =g ₁ ^(β1N) g ₂ ^(β2N) modp Γ₁ =g ₁ ^(γ1) modp, . . . , Γ _(N) =g ₁ ^(γN) modp  which are calculated by the secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i) the prime number p, the measure q, the elements g1, g2, and a Hash function hash ( ), and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates preparatory information C 1 ₁ =g ₁ ^(k) modp, C 1 ₂ =g ₂ ^(k) modp, (2) the chairman terminal calculates exclusive information C 2 _(i1)=Γ_(i1){circumflex over ( )}(k×λ(i ₁, α) modq) modp, . . . , C 2 _(id)=Γ_(id){circumflex over ( )}(k×λ(i _(d), α) modq) modp  based on a set a of d particular terminals i₁, . . . , i_(d), λ(i₁, α), . . . , λ(i_(d), α), and the public information Γ_(i1), . . . , Γ_(iD), (3) the chairman terminal calculates verification information v=A ^(k) B{circumflex over ( )}{(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq), v _(i1) =[A _(i1) ^(k) B _(i1){circumflex over ( )}{(c×k) modq}]{circumflex over ( )}{λ(i ₁, α) modq} modp, . . . , v _(iD) =[A _(id) ^(k) B _(id){circumflex over ( )}{(c×k) modq}]{circumflex over ( )}{λ(i _(d), α) modq} modp  and broadcasts the verification information together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d), to all terminals, (4) the chairman terminal calculates a common key  K=Γ ^(k) modp (5) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}) and T _(j)={Π(j−L)}/j (product of LεΛ _(j) −{j} is calculated)  where Λ={j, i₁, . . . , i_(d)}, and then calculate a verification equation {C 1 ₁{circumflex over ( )}((α1 _(j)+β1 _(j) ×c)×λ(j, Λ_(j))T _(j) modq)} ×{C 1 ₂{circumflex over ( )}((α2 _(j)+β2 _(j) ×c)×λ(j, Λ_(j))T _(j) modq)} ×v _(i1){circumflex over ( )}{λ(i ₁ , {j, i ₁})×T _(j) modq}× . . . ×v _(id){circumflex over ( )}{λ(i _(d) , {j, i _(d)})×T _(j) modq} modp=v{circumflex over ( )}{T _(j) modq} modp (c=hash (C 1 ₁ , C 1 ₂) modq)  by using the public keys A, B of the system and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), and then stop key sharing unless the verification equation is satisfied and, if the verification equation is satisfied, (6) the respective terminals j calculate cession keys K _(j) =C 1{circumflex over ( )}{γ_(j)×λ(j, Λ _(j))×T _(j) modq}×C 2 _(i1){circumflex over ( )}{λ(i ₁ , {j, i ₁ 56 )×T _(j) modq}× . . . ×C 2 _(id){circumflex over ( )}{λ(i _(d) , {j, i _(d) 56 )×T _(j) modq} modp  by using the T_(j), λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}), the preparatory information C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information γ_(j), and calculates a power residue value of K_(j) K _(j){circumflex over ( )}(1/T _(j) modq) modp  which has 1/T_(j) as an exponent and p as a modulus to thus obtain the common key K (=(g₁ ^(γ))^(k) modp).
 63. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are α1, α2, β1, β2, γ, a prime number which is larger than α1, α2, β1, β2, γ and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g1, g2, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i) in secret to satisfy α1=Σλ(i, Λ)×α1 _(i) (sum of iεΛ is calculated) (where α1 _(i)=α1+f₁×i¹+ . . . +f_(d)×i^(d) modq) α2=Σλ(i, Λ)×α2 _(i) (sum of iεΛ is calculated) (where α2 _(i)=α2+f₁×i¹+ . . . +f_(d)×i^(d) modq) β1=Σλ(i, Λ)×β1 _(i) (sum of iεΛ is calculated) (where β1 _(i)=β1+f₁×i¹+ . . . +f_(d)×i^(d) modq) β2=Σλ(i, Λ)×β2 _(i) (sum of iεΛ is calculated) (where β2 _(i)=β2+f₁×i¹+ . . . +f_(d)×i^(d) modq) γ=Σλ(i, Λ)×γ_(i) (sum of iεΛ is calculated) (where γ_(i)=γ+f₁×i¹+ . . . +f_(d)×i^(d) modq) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use public keys of the system A=g ₁ ^(α1) g ₂ ^(α2) modp, B=g ₁ ^(β1) g ₂ ^(β2) modp, Γ=g ₁ ^(γ) modp,  public information A ₁ =g ₁ ^(α11) g ₂ ^(α21) modp, . . . , A _(N) =g ₁ ^(α1N) g ₂ ^(α2N) modp B ₁ =g ₁ ^(β11) g ₂ ^(β21) modp, . . . , B _(N) =g ₁ ^(β1N) g ₂ ^(β2N) modp Γ₁ =g ₁ ^(γ1) modp, . . . , Γ _(N) =g ₁ ^(γN) modp  which are calculated by the secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i), the prime number p, the measure q, the elements g1, g2, and a Hash function hash ( ), and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates preparatory information C 1 ₁ =g ₁ ^(k) modp, C 1 ₂ =g ₂ ^(k) modp, (2) the chairman terminal calculates exclusive information C 2 _(i1)=Γ_(i1) ^(k) modp, . . . , C 2 _(id)=Γ_(id) ^(k) modp  based on the public information Γ_(i1), . . . , Γ_(id) of the d particular terminals i₁, . . . , i_(d), (3) the chairman terminal calculates verification information v=A ^(k) B{circumflex over ( )}(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq), v _(i1) =A _(i1) ^(k) B _(i1){circumflex over ( )}{(c×k) modq} modp, . . . , v _(id) =A _(id) ^(k) B _(id){circumflex over ( )}{(c×k) modq} modp  and broadcasts the verification information together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d) to all terminals, (4) the chairman terminal calculates a common key K=Γ ^(k) modp, (5) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate inverse elements E _(i1) =V _(i1) ⁽⁻¹⁾ modp, . . . , E _(id) =V _(id) ⁽⁻¹⁾ modp  of the verification information v_(i1), . . . , v_(id), calculate λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}) where Λ={j, i₁, . . . , i_(d)}, calculate a verification equation {C 1 ₁{circumflex over ( )}((α1 _(j)+β1 _(j) ×c)×λ(j, Λ _(j))×t _(j) modq)} ×C 1 ₂{circumflex over ( )}((α2 _(j)+β2 _(j) ×c)×λ(j, Λ _(j))×t _(j) modq)} ×v _(i1){circumflex over ( )}{λ(i ₁, Λ_(j))×t _(j) modq}× . . . ×v _(id){circumflex over ( )}{λ(i _(d), Λ_(j))×t _(j) modq} modp=v{circumflex over ( )}{t _(j) modq} modp (c=hash (C 1 ₁ , C 1 ₂) modq)  by using a positive square root t_(j) of an absolute value of a product of these denominators, the public keys A, B of the system, and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), replace λ(i₁, Λ_(j)) with |λ(i₁, Λ_(j))| and replace V_(i1) with E_(i1) if λ(i₁, Λ_(j))<0 while replace λ(i_(d), Λ_(j)) with |λ(i_(d), Λ_(j))| and replace V_(id) with E_(id) if λ(i_(d), Λ_(j))<0, and then stop key sharing unless the verification equation is satisfied and, if the verification equation is satisfied, (6) the respective terminals j calculate inverse elements F _(i1) =C 2 _(i1) ⁽⁻¹) modp, . . . , F _(id) =C 2 _(id) ⁽⁻¹⁾ modp  of the exclusive information C2 _(i1), . . . , C2 _(id), calculates cession keys K _(j) =C 1{circumflex over ( )}{γ_(j)×λ(j, Λ _(j))×t _(j) modq}×C 2 _(i1){circumflex over ( )}{λ(i ₁, Λ_(j))×t _(j) modq}× . . . ×C 2 _(id){circumflex over ( )}{λ(i _(d) , {j, Λ _(j)})×t _(j) modq} modp  by using the t_(j), λ(j, Λ_(j)), λ(i₁, Λ_(j)), . . . , λ(i_(d), Λ_(j)), the preparatory information C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information γ_(j), replace λ(i₁, Λ_(j)) with |λ(i₁, Λ_(j))| and replace C2 _(i1) with F_(i1) if λ(i₁, Λ_(j))<0 while replace λ(i_(d), Λ_(j)) with |λ(i_(d), Λ_(j))| and replace C2 _(id) with F_(id) if λ(i_(d), Λ_(j))<0, and calculates a power residue value of K_(j) K _(j){circumflex over ( )}(1/t _(j) modq) modp  which has 1/t_(j) as an exponent and p as a modulus to thus obtain the common key K (=(g₁ ^(γ))^(k) modp).
 64. An exclusive key sharing method for a communication system which consists of N terminals (N is an integer of more than 2) connected mutually to allow broadcast communication, wherein secret keys are α1, α2, β1, β2, γ, a prime number which is larger than α1, α2, β1, β2, γ and N or a power number of the prime number is p, a measure of (p−1) is q, elements of GF(p) are g1, g2, and a particular terminal number which can be specified by a chairman terminal φ (to which any terminal can be appointed) is d (1≦d<N−1), respective terminals i (1≦i≦N) hold secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i) in secret to satisfy α1=Σλ(i, Λ)×α1 _(i) (sum of iεΛ is calculated) (where α1 _(i)=α1+f₁×i¹+ . . . +f_(d)×i^(d) modq) α2=Σλ(i, Λ)×α2 _(i) (sum of iεΛ is calculated) (where α2 _(i)=α2+f₁×i¹+ . . . +f_(d)×i^(d) modq) β1=Σλ(i, Λ)×β1 _(i) (sum of iεΛ is calculated) (where β1 _(i)=β1+f₁×i¹+ . . . +f_(d)×i^(d) modq) β2=Σλ(i, Λ)×β2 _(i) (sum of iεΛ is calculated) (where β2 _(i)=β2+f₁×i¹+ . . . +f_(d)×i^(d) modq) γ=Σλ(i, Λ)×γ_(i) (sum of iεΛ is calculated) (where γ_(i)=γ+f₁×i¹+ . . . +f_(d)×i^(d) modq) λ(i, Λ)=Π{L/(L−i)} (product of LεΛ−{i} is calculated) (where f₁, . . . , f_(d) are d elements of GF(q), f_(d)≠0, and Λ is a set of any (d+1) terminals out of the N terminals), and can use public keys of the system A=g ₁ ^(α1) g ₂ ^(α2) modp, B=g ₁ ^(β1) g ₂ ^(β2) modp, Γ=g ₁ ^(γ) modp,  public information A ₁ =g ₁ ^(α11) g ₂ ^(α21) modp, . . . , A _(N) =g ₁ ^(α1N) g ₂ ^(α2N) modp B ₁ =g ₁ ^(β11) g ₂ ^(β21) modp, . . . , B _(N) =g ₁ ^(β1N) g ₂ ^(β2N) modp Γ₁ =g ₁ ^(γ1) modp, . . . , Γ _(N) =g ₁ ^(γN) modp  which are calculated by the secret information α1 _(i), α2 _(i), β1 _(i), β2 _(i), γ_(i), the prime number p, the measure q, the elements g1, g2, and a Hash function hash ( ), and (1) the chairman terminal generates arbitrarily a non-zero element k of GF(q), and calculates preparatory information C 1 ₁ =g ₁ ^(k) modp, C 1 ₂ =g ₂ ^(k) modp, (2) the chairman terminal calculates exclusive information C 2 _(i1)=Γ_(i1){circumflex over ( )}(k×λ(i ₁, α) modq) modp, . . . , C 2 _(id)=Γ_(id){circumflex over ( )}(k×λ(i _(d), α) modq) modp  based on a set α of the d particular terminals i₁, . . . , i_(d), λ(i₁, α), . . . , (i_(d), α), and the public information Γ_(i1), . . . Γ_(id), (3) the chairman terminal calculates verification information v=A ^(k) B{circumflex over ( )}{(c×k) modq} modp (c=hash(C 1 ₁ , C 1 ₂) modq), v _(i1) [=A _(i1) ^(k) B _(i1){circumflex over ( )}{(c×k) modq}]{circumflex over ( )}{λ(i ₁, α) modq} modp, . . . , v _(id) [=A _(id) ^(k) B _(id){circumflex over ( )}{(c×k) modq}]{circumflex over ( )}{λ(i _(d), α) modq} modp  and broadcasts the verification information together with the exclusive information C2 _(i1), . . . , C2 _(id), the particular terminal numbers i₁, . . . , i_(d) to all terminals, (4) the chairman terminal calculates a common key  K=Γ ^(k) modp, (5) the respective terminals j (j≠i₁, . . . , i_(d), φ) calculate inverse elements E _(i1) =V _(i1) ⁽⁻¹⁾ modp, . . . , E _(id) =V _(id) ⁽⁻¹⁾ modp  of the verification information v_(i1), . . . , v_(id), calculate λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}) and T _(j)={Π(j−L)}/j (product of LεΛ _(j) −{j} is calculated)  where Λ_(j)={j, i₁, . . . , i_(d)}, calculate a verification equation {C 1 ₁{circumflex over ( )}((α1 _(j)+β1 _(j) ×c)×λ(j, Λ _(j))T _(j) modq)} ×{C 1 ₂{circumflex over ( )}((α2 _(j)+β2 _(j) ×c)×λ(j, Λ _(j))T _(j) modq)} ×v _(i1){circumflex over ( )}{λ(i ₁ , {j, i ₁})×T _(j) modq}× . . . ×v _(id){circumflex over ( )}{λ(i _(d) , {j, i _(d)})×T _(j) modq} modp=v{circumflex over ( )}{T _(j) modq} modp (c=hash (C 1 ₁ , C 1 ₂) modq)  by using the public keys A, B of the system, and own secret information α1 _(j), α2 _(j), β1 _(j), β2 _(j), replace λ(i₁, {j, i₁})×T_(j), with |λ(i₁, {j, i₁})×T_(j)| and replace V_(i1) with E_(i1) if λ(i₁, {j, i₁})×T_(j)<0 while replace λ(i_(d), {j, i_(d)})×T_(j)) with |λ(i_(d), {j, i_(d)})×T_(j)| and replace V_(id) with E_(id) if λ(i_(d), {j, i_(d)})×T_(j))<0, and then stop key sharing unless the verification equation is satisfied and, if the verification equation is satisfied, (6) the respective terminals j calculate inverse elements F _(i1) =C 2 _(i1) ⁽⁻¹) modp, . . . , F _(id) =C 2 _(id) ⁽⁻¹⁾ modp  of the exclusive information C2 _(i1), . . . , C2 _(id), calculates cession keys K _(j) =C 1{circumflex over ( )}{γ_(j)×λ(j, Λ _(j))×T _(j) modq}×C 2 _(i1){circumflex over ( )}{λ(i ₁ , {j, i ₁})×T _(j) modq}× . . . ×C 2 _(id){circumflex over ( )}{λ(i _(d) , {j, i _(d)})×t _(j) modq} modp  by using the t_(j), the λ(j, Λ_(j)), λ(i₁, {j, i₁}), . . . , λ(i_(d), {j, i_(d)}), the preparatory information C1, the exclusive information C2 _(i1), . . . , C2 _(id), and own secret information γ_(j), replace λ(i₁, {j, i₁})×T_(j) with |λ(i₁, {j, i₁})×T_(j)| and replace C2 _(i1) with F_(i1) if λ(i₁, {j, i₁})×T_(j)<0 while replace λ(i_(d), {j, i_(d)})×T_(j) with |λ(i_(d), {j, i_(d)})×T_(j)| and replace C2 _(id) F_(id) if λ(i_(d), {j, i_(d)})×T_(j)<0, and calculates a power residue value of K_(j) K _(j){circumflex over ( )}(1/T _(j) modq) modp  which has 1/T_(j) as an exponent and p as a modulus to thus obtain the common key K (=(g₁ ^(γ))^(k) modp).
 65. An exclusive key sharing method according to claims 57, 58, 60, 61, 63 or 64, wherein the chairman terminal calculates the inverse elements of the exclusive information or the verification information and broadcasts them to all terminals.
 66. An exclusive key sharing method according to claims 1 to 19, 21 to 26, 30, 41, 44, 45, 49 to 54, or 56 to 64, wherein the multiplication operation is caused to correspond to an addition operation on a curve such as an elliptic curve on any finite field. 